YOUR FILES, YOUR CHOICE

Privacy policy

Last updated: 25 September 2026

Filestation is an independent browser-based PDF workspace made and operated by okay.sahib. This notice explains the current public tools at filestation.io.

1. Documents you choose

Local PDF tools read and process your selected files on your device, using your browser. File contents, signatures, form values and annotations are used to perform the operation you request. Choosing a file alone does not upload it. Image compression and JSON/CSV tools also process their input locally in the current browser tab. Assignment Pack checks use your chosen page and size limits without sending document contents to a server. Optional server conversion is described below. Optional cloud storage is available through your account. Files stay local unless you choose to save them to your account.

Working files are held in the current browser session. Leaving the page, refreshing it or changing tools can discard your work. Download the result first. Downloads are stored wherever you or your browser choose and remain there until you delete them. Your device, browser extensions, backups and cloud-synced folders have their own privacy settings.

2. Website connections and hosting

Opening any website sends technical information to its hosting infrastructure. This may include an IP address, requested URL, browser information, time of request and error or security information. Filestation is hosted using OpenAI Sites and its infrastructure providers. Such information may be processed to deliver the site, maintain availability and prevent abuse. This is separate from the contents of documents processed locally.

Provider-controlled logs, retention periods and international processing are governed by the relevant provider arrangements and policies; we cannot promise that all technical data is immediately deleted or held only in one country. See OpenAI’s privacy policy for its description of its own processing. It does not replace this notice.

3. Cookies and browser storage

Google Analytics is optional and loads only after you accept analytics in Cookie settings. It measures public-page visits and general browser/device information using Google Analytics cookies (configured for 90 days). Google receives technical connection data, including your IP address; we do not send document contents, filenames, account identifiers, form values, or URL query strings and fragments. Automatic form, search and file-download measurement and advertising personalization are disabled. Account, billing, team and private dashboard pages do not load analytics. Your consent preference is stored on this device for up to 180 days. Choose Cookie settings here to reopen the popup and withdraw consent; this stops further analytics and removes accessible Analytics cookies. Rejecting analytics does not limit the tools. Google may process information internationally under its privacy policy (https://policies.google.com/privacy). AdSense site verification is installed; advertising is not yet enabled. A separate advertising consent setup and updated notice will be provided before ads are activated. Guest downloads require an email address, stored with a random browser identifier and up to six download records in our database. The identifier is held in a necessary first-party cookie for one year. Clearing browser data or using another browser may change the count. We record your marketing preference separately: checking the optional box permits FileStation updates and offers; leaving it unchecked means your address is used for the guest download record only. You may withdraw marketing consent or request deletion at info@filestation.io. We do not verify ownership of the email address before allowing a download. Download limits are checked against your signed-in account on the server. We store a random result identifier, account identifier and daily time bucket to enforce the Free limit across devices. Old daily allowance records are removed when that account next requests a Free download. The navigation component writes a first-party sidebar_state preference cookie, with a configured lifetime of seven days, to remember navigation state. Hosting infrastructure may use additional necessary security or access mechanisms. You can control cookies and clear site data through your browser settings.

OCR and password tools

OCR downloads its English recognition data from this website and may cache that data in your browser. The documents it reads stay on your device. Protect PDF and Unlock PDF process the file and its password in a temporary local worker; FileStation does not store or receive the password. Protect PDF applies AES-256 encryption only when you choose that tool.

The PDF AI tools remain disabled. The separate paraphrasing tool runs a language model locally in your browser after you allow its download. Your pasted writing and generated drafts are not sent to a rewriting server or saved by FileStation. Model downloads contact Hugging Face and its delivery providers, which receive normal technical connection information such as your IP address. Downloaded model files may be stored in your browser cache; you can remove them through browser site-data controls. Refreshing or leaving the paraphrasing page discards its drafts. Share PDF and manual signature requests use an app you choose; that app has its own processing and privacy policy.

Optional server conversion

When connected, the Office layout renderer, Apple Pages converter and PDF/A converter send your selected file through FileStation to its document processor only after you confirm upload. The connection uses HTTPS. The processor creates temporary files for the job and removes them when processing ends; it does not provide persistent document storage. These modes accept up to 20 MB per file. Conversion may change fonts, pagination or unsupported features.

Server modes are not end-to-end encrypted: the processor must read the submitted contents. Technical hosting and reverse-proxy logs may still exist under the hosting provider’s policies.

To protect availability, server requests use a salted hash of the network address and hourly interval for request counting. These entries expire after two hours and are removed on later requests. They contain no document text. Local tools remain available without using this processor. The tool checks engine availability and blocks server processing until a connection is ready.

Expiring PDF links

Creating a sharing link requires a signed-in account and a saved PDF. If the PDF is not already saved, you must confirm its upload. You can choose a one-hour, 24-hour or seven-day expiry and an optional password. Anyone with the link and the password, if set, can download the PDF without signing in. Revoking a link, deleting its saved PDF or reaching its expiry stops new downloads. It does not recall previously downloaded copies or delete the owner’s saved PDF.

We store the file reference, account identifier, creation and expiry times, a hash of the random sharing token and, when used, a salted password-derived hash. The sharing password is sent over HTTPS for verification; it is not stored as plain text. This controls access to the link and is not end-to-end encryption or PDF password encryption. Password checks are limited per link. Expired link records are removed when the owner creates another link. Shared-file pages do not load Google Analytics.

Home-screen installation

You may install the website as a web app in supported browsers. The service worker caches a generic offline notice, code assets used by visited tools and selected local tool pages after a successful online visit. It does not cache account pages, API responses or PDFs. An offline revisit may work only when the necessary code was previously loaded. Internet is needed for new tools, cloud features and updates. Existing browser caches and local sign-in recovery are separate.

Account sign-in

When enabled, account access uses Google sign-in. Google supplies a verified account identifier, email and optional display name. We use these to recognize signed-in visitors and permit continued free downloads. Filestation stores this identity in a signed, Secure, HttpOnly session cookie for up to seven days. A separate sign-in cookie expires after ten minutes. We do not keep Google access or refresh tokens. Signing in does not upload your PDFs or create a cloud backup. We do not request access to Gmail or Google Drive and never receive your Google password. Google handles its sign-in page under its own privacy policy. Signing out clears the Filestation session cookie.

Optional tool analytics

If you accept analytics, we may record which tool was opened, when processing started, when output was prepared, when an operation failed, when a download was initiated and when a guide linked to a tool. Parameters are limited to a tool identifier, a broad device class and consent state. We do not include document contents, filenames, passwords, account identifiers or private URLs. A download event means a browser handoff, not proof the file was saved.

Temporary sign-in recovery

Before leaving a tool to sign in, FileStation saves the current files, edits, settings and prepared result in browser storage on this device. This recovery copy is not uploaded or sent to analytics. PDF passwords are not saved. It expires after 24 hours and is removed after successful restoration; expired copies are deleted the next time recovery storage is used. Use the same browser and tab. Clearing site data removes recovery copies. This is not continuous autosave or a backup service.

Saved files, drafts and download history

For signed-in users, we store download filenames, sizes, dates and the requested save action in your account history. The browser cannot always confirm a download completed. This does not upload document contents. You can clear this history from My downloads & drafts.

Choosing Save to account uploads the selected result, or the source PDF and its editable draft state (including images and signatures), to private server storage. Account ownership controls access. Cloud storage is not end-to-end encrypted. Saved items remain until you delete them from your dashboard; deleting an item removes its active stored copy, although infrastructure backups and logs may follow provider retention schedules. Free accounts include 3 saved items; Pro has no saved-item count limit, up to 25 MB each. Cancelling Pro does not delete existing items, but new saves are restricted to your current plan allowance. Download your own backups. Contact us for account-data requests.

Team membership

Team owners see member email addresses and manage invitations and seats. We store membership records and hashed invitation tokens. Invitations expire after seven days; membership lasts until removed or the member leaves. Team owners cannot read member documents through the team feature. Paid access depends on the team subscription. No invitation email is sent automatically; the owner shares the link.

Payments and billing

Stripe processes card payments on its hosted checkout. Filestation will retain the account-to-customer link, subscription identifiers, status, billing period and payment-event identifiers needed to manage access and billing. Stripe receives your email and payment information for processing. Filestation does not store full card numbers or security codes. See Stripe’s privacy policy. Billing information may need to be retained to meet accounting requirements or resolve disputes; contact us about access or deletion requests.

4. Security and encryption

HTTPS encrypts the connection between your browser and the website. Local PDF processing reduces the need to transfer document contents. It does not automatically password-encrypt a PDF or your downloaded result, and it is not a promise of end-to-end encrypted storage. No website or device can guarantee 100% security.

Use a trusted device and an up-to-date browser. Keep original copies and review exports before sharing them. Cropping, covering text or placing a watermark is not secure redaction.

5. Messages and external links

Contact info@filestation.io for support, sales and privacy requests. Your email address, message and information you choose to include are used to answer the enquiry. Do not send passwords, payment details or confidential documents. The footer also links to the creator’s Instagram, a separate service with its own policies.

Enquiry information is kept only as long as reasonably needed to answer, resolve related issues and meet applicable legal requirements. The messaging provider may retain its own copy under its policies. We do not sell documents or contact messages or use local document contents to train AI models.

6. Purposes, lawful basis and sharing

Where UK data protection law applies to personal data we control, responding to enquiries and maintaining a reliable, secure website are our legitimate interests. You may object to processing based on legitimate interests. We may also retain information where necessary to comply with legal obligations. Account access, requested storage, team membership and billing are processed to provide the service under our contract with you. Local document contents are processed at your direction on your device rather than collected into our database.

Information may be handled by the providers needed to host the website or receive your messages, or disclosed where legally required. This site does not ask you to consent to advertising or profile you for advertising.

7. Your choices and rights

Where applicable, you may request access, correction, erasure, restriction or portability of personal data we hold, and object to processing based on legitimate interests. Contact info@filestation.io and describe your request without including your document. We cannot retrieve or delete documents that remain only on your device. You can also complain to the UK Information Commissioner’s Office or your local data protection authority.

8. Blog publishing and video tools

The public blog is readable without an account. Its owner-only publishing desk uses Google sign-in and checks the authenticated owner account. Article content, publication status and editing timestamps are stored to publish and maintain the blog. Drafts are not available on public article pages. Published article URLs may be sent to participating search engines using IndexNow to notify them of updates; draft text and owner sign-in details are not included.

Video downloads, when activated, send the video link and chosen quality to a separate processor after you submit the form. This differs from local PDF processing. The processor uses anonymous access and does not accept your platform password or cookies. Temporary video files and jobs expire after 15 minutes. Hashed network identifiers are used for request limits, expire after two hours and are cleaned up on subsequent requests; hosting or reverse-proxy logs may have their own retention. The tool displays an unavailable notice until that processor is connected.

9. Changes to this notice

If document uploads, accounts, analytics, paid services or additional processing are introduced, this notice will be updated to explain the changes. The date above identifies this version.