Privacy Policy

Effective November 1, 2026 · Last updated November 2, 2026

Your documents never leave your device. Accounts are optional, we don’t sell your information for money, and we collect as little as we can. Ads from Google pay for the service, and this policy explains what they collect and how to control it.

1. Who we are

EditMyDocument.com is owned and operated by Havard Solutions LLC, an Alabama limited liability company (“Havard Solutions”, “we”, “us”, “our”). Havard Solutions LLC is the “controller” of personal information described in this policy. Questions go to support@havardsolutions.com. Our mailing address is available on request by email.

2. Your documents

When you open a PDF, Word, Excel, PowerPoint, text or image file on EditMyDocument.com, it is read and processed by code running in your own web browser. Your files, the text you type, the signatures you draw or type, the passwords you enter to protect or open a PDF, and the text recognized by OCR are not uploaded to our servers or to anyone else’s. We cannot see them. They stay in your browser tab until you save them to your device or close the tab.

To work offline, the site stores its own program files (not your documents) in your browser’s cache. You can clear them at any time in your browser settings.

3. What we collect

Unless you create an account, we do not ask for your name. Optional metrics are off by default for everyone and separate from ad consent. With your affirmative opt in, the browser sends only a short allowlisted event and tool slug to our own server: tool_select when a tool page opens, file_open after a file successfully opens, export when a download is started or delivered, or a generic error when an operation fails. No filenames, document contents, text, signatures, passwords, error messages, IP addresses, user agents, account IDs, or persistent visitor IDs are sent in the metrics payload or stored in the metrics table. The server uses its own UTC day and immediately adds one to that day’s event/tool count; it does not save individual events. No tool-page event is sent retroactively when you opt in, and no event is sent for file work on the home page without an allowlisted tool slug. This does not affect ads or optional account features.

To limit automated submissions, our server derives a temporary hourly HMAC pseudonym from the request’s network IP address and a server secret. It stores only the HMAC, a count and its expiry in the separate SQLite database used for metrics, not the raw IP address, browser user agent, account details, or any document information. We accept at most 60 metric events per network IP per UTC hour, 1,000 per event/tool per UTC day, and 10,000 across all events per UTC day; excess submissions are rejected. People on a shared IP can affect each other’s limit. These safeguards reduce but do not prevent fabricated submissions: the counts are not unique visitors and are not Sybil-proof.

A metrics request is still a normal web request: our host may receive the IP address, browser details, requested API URL and time in separate access logs. We send no document information in the URL or referrer. Host access logs and any ad-partner data are not part of the aggregate metrics table and have separate rules and retention below. We do not knowingly collect sensitive information in our metrics; any personal details inside your documents stay on your device, whether or not you’re signed in. Accounts are never required: every tool works without one.

4. Advertising and cookies

We use Google AdSense to show ads on guides and other informational pages. Editor pages do not load Google ad scripts. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet. Other ad vendors and networks approved by Google may also serve ads on informational pages; you can see them in the regional consent message where available. The footer’s Privacy & ad info link explains these choices; on informational pages where Google's consent tool exposes revocation, the link becomes Ad privacy choices and reopens that tool.

You can opt out of personalized advertising at Google Ads Settings, and opt out of some third-party vendors’ use of cookies at aboutads.info (US) or youronlinechoices.eu (Europe). Learn how Google uses information from sites that use its services. Details of each cookie are in our Cookie Policy.

5. How information is used

• To run, secure and improve the website and fix problems.
• To run your optional account: sign you in, keep your saved signatures and settings available on your devices, and send you account emails such as confirmation links, password resets and new sign-in alerts (which you can turn off).
• To show advertising that pays for the free service, as described above.
• To answer your messages and handle privacy, accessibility, copyright and security requests.
• To meet legal obligations and enforce our Terms of Service.

We don’t use your information to make decisions that have legal or similarly significant effects on you.

6. Who we share with

• Our host (Spaceship (cPanel web hosting)), which delivers the website and protects it from attacks, as our service provider.
• Google and its ad partners, which receive advertising data directly from your browser as described above.
• Our email provider, which stores messages you send us.
• Authorities or others when required by law, to protect rights and safety, or as part of a sale or reorganization of the business (the new owner would be bound by this policy).

We do not sell personal information for money. Under some US state laws, letting ad partners collect information through cookies can count as a “sale” or “sharing” for targeted advertising; you can opt out as described in section 7.

7. Your choices

• Optional first-party metrics (everyone): use Allow anonymous metrics in the footer to opt in; there is no prechecked consent. Use Turn off anonymous metrics in the same place to opt out at any time. Opting out stops new event requests from your browser immediately and removes the consent cookie when the server responds; if offline, your browser remembers to retry cookie removal. Earlier daily counts cannot be linked back to you or removed individually. This choice does not change Google advertising consent.
• EEA, UK and Switzerland: on informational pages where Google shows its consent message, you can use Ad privacy choices in the footer to reopen it when that control is available. Otherwise the footer links to Privacy & ad info; you can clear site cookies and contact us for help with withdrawing consent.
• US states with privacy laws (including California, Virginia, Colorado, Connecticut, Texas and others): a Google-provided Do Not Sell or Share My Personal Information link may appear on informational pages in applicable regions. Browsers that send a Global Privacy Control signal are treated as opting out where the law requires. See our US State Privacy Notice.
• Everyone: block or delete cookies in your browser and use the opt-out links in section 4. You’ll still see ads, but they’ll be less personalized.

8. Your rights

Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy, to correct or delete it, to object to or restrict its use, to withdraw consent, and to opt out of targeted advertising or “sales”. If you have an account, you can do much of this yourself: Account › Your data lets you download your account data, including contact messages linked to your account, and delete your account and its linked messages immediately. Account › Profile lets you correct your name and email. Direct emails, copies held by our email provider and messages sent without signing in are not in the account download and are not removed by account deletion; request access or deletion by emailing us so we can verify the request. We never hold your documents. Data held by Google can be managed with Google’s tools above.

To make a request, email support@havardsolutions.com. We respond within 30 days (45 days where US state law allows), may need to confirm you made the request, and will not treat you differently for using your rights. An authorized agent may act for you with your written permission. If we decline a request, you may appeal by replying to our answer; we’ll respond to appeals within 45 days. You may also complain to your local data protection authority or state attorney general. More detail for EEA and UK visitors and US residents.

9. How long we keep it

• Documents: never received, so never kept.
• Optional metrics: daily counts and daily abuse-budget totals are kept for a rolling 90 UTC days (including today); older rows are deleted on the next accepted opted-in event. Temporary IP-derived HMAC rate-limit entries expire at the end of their UTC hour and are deleted on the next accepted opted-in event after expiry. If traffic stops, expired rows can remain until maintenance; neither schedule means automatic deletion without a later request. We do not retain individual events or raw IPs in this separate metrics database. The non-identifying consent cookie expires after 180 days; browser local storage keeps the opt-in choice until you turn it off, clear site data, or the next event gets a rejected consent response. A pending revocation marker remains until cookie removal succeeds.
• Account data and linked contact messages: until you delete your account, which removes them immediately. Sign-in history is kept for 12 months. Unused confirmation and reset links expire within hours and are purged.
• Hosting request/access logs: separate from the metrics table and controlled by Spaceship (cPanel web hosting) under its own retention schedule. Ask us for current details; we do not claim the 90-day metrics schedule applies to host logs.
• Messages sent without signing in and emails you send us: until the matter is resolved, then up to 24 months for our records, unless the law requires longer. Copies held by our email provider may have separate retention.
• Advertising data: kept by Google and its partners under their own policies.

10. Security

The site is served only over encrypted HTTPS. Because your documents are processed on your own device, there is no store of user files to breach. Account passwords are stored only as salted hashes, two-step verification secrets are encrypted at rest, and you can see and sign out of every device from your Security page. No system is perfectly secure; see our Security Policy for how to report a vulnerability.

11. Children

EditMyDocument.com is a general-audience service and is not directed at children under 13. We don’t knowingly collect personal information from children under 13. See our Children’s Privacy Notice.

12. International visitors

We are based in the United States. Information processed by our host and by Google may be handled in the US and other countries under their own safeguards, such as standard contractual clauses and the EU-US Data Privacy Framework where they participate.

13. Do Not Track

Our site does not currently respond to browser “Do Not Track” signals, because there is no common standard for them. Third parties such as Google may collect information about your online activities over time and across different websites when you use our site. We do honor Global Privacy Control signals as described in section 7.

14. Changes to this policy

When we change this policy, we post the new version here and update the dates at the top. If a change is significant, we’ll also show a notice on the home page for at least 30 days.

15. Contact

Havard Solutions LLC, operator of EditMyDocument.com. Email: support@havardsolutions.com. Our mailing address is available on request by email.