Smallpdf, PDF24, iLovePDF — what their privacy policies actually let them do

This document compares the published privacy positions of three of the most-used online PDF tools — Smallpdf, PDF24, and iLovePDF. The goal isn’t to argue any of them is acting in bad faith; all three are responsible operators on the AEC scale. The goal is to show what each one’s policy permits on paper, which is broader than the marketing copy suggests, and what the local-first alternative removes from that surface area.

Sources for each retention claim are cited inline. Access dates are in the citations block at the bottom of the post.

Smallpdf

Stated retention. Anonymous files processed by free tools are deleted within one hour. Files routed through eSign or shared via file-sharing are kept up to 14 days. Pro users with active File Storage can retain files indefinitely until manually deleted. Source: the HonestPDF Smallpdf review summarising Smallpdf’s published policy.

Infrastructure. Hosted on Google Cloud Platform, primarily in Europe.

What the policy permits beyond the obvious.

• Aggregation of usage statistics across users, with file metadata retained beyond the file itself.
• Sharing data with sub-processors (cloud providers, payment processors, analytics vendors). The policy lists them.
• Account data retention indefinite while account is active, plus the standard accounting / legal-retention overlay after deletion.
• Marketing communications to account holders unless opted out.

Surface area observation. Responsible operator, conservative retention for the routine file-processing use case, normal account-data retention for Pro tier. The “file deleted in one hour” claim applies to the file content; metadata about the operation persists longer.

PDF24

Stated retention. One-hour deletion window for processed files, with the option to manually delete sooner if logged in. Source: HonestPDF PDF24 review.

Infrastructure. PDF24’s online tools run on infrastructure operated by Geek Software GmbH (the company behind PDF24).

What the policy permits beyond the obvious.

• Use of essential and analytics cookies (cookie banner present).
• Standard sub-processor relationships (hosting, analytics).
• A free desktop tool (“PDF24 Creator”) that processes locally — interesting because it suggests PDF24 themselves know local-first is the privacy story; they just don’t apply it to the online tools.

Surface area observation. Probably the most privacy-pragmatic of the three. Short retention window, no aggressive cross-context tracking, local desktop tool for users who want it. Still uploads the file during the online flow.

iLovePDF

Stated retention. 1, 2, or 24 hours depending on account tier. Source: iLovePDF Privacy and HonestPDF iLovePDF review.

Infrastructure. Cloud (specific provider not stated on the public page; ISO 27001 certified for the operations).

What the policy permits beyond the obvious.

• Cross-product feature integration — sharing data between iLovePDF web, mobile, and desktop products for the same user.
• Marketing communications subject to opt-out.
• Use of sub-processors listed in the policy.
• For team / business plans, additional admin-side access to member-uploaded files within the team workspace.

Surface area observation. Similar to Smallpdf — responsible operator, short retention by default, broader allowances for paid tiers. The ISO 27001 cert means an external auditor has reviewed the controls; that’s a meaningful signal.

Side-by-side surface area

Surface	Smallpdf	PDF24	iLovePDF	Loft
File uploaded to server	yes	yes	yes	no
File deleted after window	1 hr / 14 d / ∞	1 hr	1 / 2 / 24 hr	n/a
Metadata retained longer	yes	yes	yes	URL path, country, and timestamp — never file content
Account required for full features	yes	no	yes	no
Marketing email opt-in default	yes	no	yes	no
Sub-processors involved	several	a few	several	Cloudflare, Stripe, Microsoft (email) — see our privacy policy §5
File subject to operator-side breach risk	yes	yes	yes	no

The “no” cells reflect architecture, not virtue. The local-first architecture removes the opportunity for each surface; the operator can’t lose what they don’t have.

What Loft accepts in trade

The local-first architecture doesn’t get team-workspace features (because no accounts), batch processing in the cloud (because no cloud), shared real-time review (because no server). Many power-user workflows that depend on shared state across users are out of scope for us. The three operators above all ship those features and have honest reasons to do so.

For routine, single-document, occasional use — the bulk of what “online PDF tools” get used for — the local-first model has a strictly smaller privacy surface. For deep enterprise workflows across teams, the cloud-side operators are often the right tool.

Notes on methodology

We tried not to cherry-pick. All three operators in this post are major brands with millions of users and published policies. The retention windows are quoted (via HonestPDF’s summaries of the published policies) rather than inferred. We deliberately omitted weaker operators whose policies would make the comparison look more dramatic.

One thing I keep tripping over while writing this kind of comparison: the operators’ policies are written in legal-document register, and translating them into “what this permits” requires interpretation. Where I’m quoting a fact (retention windows, certifications, infrastructure provider), I cite. Where I’m interpreting what a clause permits, I say “the policy permits” rather than “the operator does.” If you’re using this post as input to a serious privacy decision, read each operator’s actual policy text alongside it.

Update policy

This document is updated when any of the three operators publishes a significant policy change. Last reviewed 2026-05-27. The retention windows are accurate as of access dates in the citations.