Privacy policy

pdf to json converter — browser extension and the service behind it. Version 1, 21 September 2026.

This extension sends documents you choose to a server that reads them and gives back structured data. That is its only purpose, and everything below describes what happens to a document on the way.

What is sent

The file you pick, or the file behind a link you click on a page.
The pages you select, if you narrow the run to some of them.
The schema — the description of the fields to pull out, either one you wrote or one the service builds.
A client identifier: a random UUID the extension generates for itself on first use. It is not derived from you, your browser or your account, and it is used to count your free attempts.

The file name is never sent. It is replaced with the literal word document before the upload leaves your browser, and it appears in no database row and no log line. A name like Contract_Ivanov_2024-09.pdf says more about the content than any other field, and nothing here has a use for it.

Where it goes

To the server operated by this extension's developer. From there, to Microsoft Azure.

What reaches Azure is images of your document's pages, not the file you uploaded: a PDF is rasterised page by page in memory, and each page is sent as a picture. A JPEG or PNG you upload is sent as it is, because it already is one. Azure Document Intelligence reads those images into text, and Azure OpenAI then builds the schema and extracts the data from that text.

Microsoft may keep some of it. Azure OpenAI runs here under its standard abuse monitoring, which means content the service flags can be retained by Microsoft and reviewed by authorised Microsoft staff. We cannot promise that nobody ever reads your document, and we do not.

How long it is kept

On the server's disk: nothing, ever. The recognised text, the schema and the result are held in the memory of the process that ran the job and are never written down. They are gone when the job's window ends — at most 1 day — or when the server restarts, whichever comes first. A restart is not rare and is not announced: if you come back to a job after one, the result is gone and there is nothing to recover.
Page images are never written either. Pages are rasterised in memory, streamed to the recogniser and dropped.
A record of the run — when it ran, which pages were asked for, how long each stage took, what it cost, whether it failed, and which version of the extension made it — is kept for 90 days. It contains no part of your document. The version is the number in the extension's manifest and nothing else; it says which build was installed, not who was using it.
A hashed IP address, used to count attempts per address per day, is kept no longer than 48 hours and then blanked. The address itself never reaches the database: what is written there is a salted SHA-256 of it, and the salt never leaves the server.
The web server's access log records the address the request came from, along with the time, the path and the response code, and is kept for 14 days. It is what lets us block an address that is attacking the service and work out afterwards what happened; it is read for nothing else, and it is never joined to the content of a document, which the server does not have. This log is ordinary web server practice and it is the one place the address appears unhashed.
The client identifier is kept for 90 days, on the same row as the record of the run and no longer than it. The allowance it counts resets every day, so the old rows decide nothing about whether you may run — they are what the operator totals a month of runs from, and they are deleted with the rest of the record. It is a random UUID and nothing else; after the 48 hours above it is the only identifier left beside a run.

Who can see it

The service has an operator's console. It shows that a run happened, which client identifier it belonged to, how many pages were asked for, what each stage cost and how the run ended. It cannot show the document, the recognised text, the schema or the result — those are never stored, so there is nothing for it to read.

What stays in your browser

Held locally by the extension and sent nowhere: your saved schemas and how often you use each, the chosen interface language, the server address, the client identifier, and the record that you accepted this disclosure. Clearing the extension's data or removing the extension removes all of it.

When the extension reads a page

The extension shows a “To JSON” button beside PDF links, and only on sites you have granted it access to — one site at a time, or all of them, your choice, revocable at any moment from the extension's window.

On a granted site, two things reach the network. Hovering a link makes the extension ask the target address whether it is a PDF, and clicking the button downloads that file — both requests carry your browser's cookies for that address, which is what lets the button work on documents behind a login. A file fetched this way is then sent to the server exactly like one you picked by hand. On a site you have not granted, nothing happens at all.

Your choices

Nothing is sent until you accept the disclosure shown in the extension the first time you open it. Before that the extension makes no network request of any kind and does not even generate its client identifier.
Site access is granted per site and can be withdrawn per site.

Deletion and contact

There is no endpoint that deletes a job on request, and there is a plain reason: by the time you could ask, the document is already gone — it never reached a disk and the process has moved on. What outlives it is the record of the run, which carries no part of your document and expires on its own after 90 days.

To ask about the client identifier held against your free allowance, or anything else here, write to pdf [dot] to [dot] json [dot] app [at] gmail [dot] com. Removing the extension and clearing its data ends the association from your side immediately: the next install mints a new identifier with no link to the old one.

Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

User data is used only to provide the single purpose described at the top of this page. It is not sold, not transferred to anyone except the processors named above, not used for advertising, and not used to build a profile of you.

Changes

When this text changes in a way that affects what is sent or kept, the extension asks again: the version above travels with your acceptance, and an agreement to an older wording does not carry over to a newer one.