Privacy

This page explains what the site does today. If anything changes, it will be updated here.

Controller

  • Controller: Menzuri Gestión S.L.
  • NIF: B-27228683
  • Registered address: Lugo, Galicia, Spain
  • Data protection contact: hola@solo2.net

Your files

All the tools on this site are designed to work inside your browser, without sending your files to any server of ours: the files you choose are read and processed in your browser's memory (including images and their thumbnails), and the result (including the ZIP files of the tools that produce several files) is created and downloaded from there. Some tools also read data that you enter or select, strictly in that page's memory: Sign PDF reads your digital certificate (.p12 or .pfx) and its password, and the password tools read the passwords you enter; these are not saved in your browser or sent anywhere, and the page discards them when done. OCR PDF loads its recognition engine and language models from this same website (files hosted on the site itself, without sending anything) and reads the text on your device. No file is sent to any server.

This website

It is a collection of static pages. Today:

  • The tools have no forms and send nothing. Only the optional account (not needed to use the tools) has username and password forms, described below.
  • Does not use cookies. It saves your language and favorite tools in your browser's local storage to remember them; if you sign in, it also keeps a session key (see below).
  • Does not load scripts, fonts, or images from other sites: everything you see is served from solopdfs.com.
  • Includes no analytics tools.
  • Every page checks whether the accounts service responds: it is a GET request to /api/health on this same site, without cookies and without sending any of your data.

Accounts (optional)

You can use all the tools without an account. If you decide to create one, the solopdfs server stores the account data, and only that. Your documents are not part of the account and are never uploaded: they stay in your browser.

What your account stores

  • Your username and a fingerprint of the password (Argon2id). The password itself is not stored and nobody can read it.
  • The email address, only if you provide one. It is optional and is not currently used to recover the account or to send you anything.
  • A recovery code, shown to you only once; we store only its fingerprint.
  • The version of the terms you accepted, the date, and that you confirmed you are at least 16 years old.
  • The day you created the account and the last day you used it (date only, no time).
  • Your settings (up to 16 KB). They do not include documents, certificates or passwords. If your account has an active paid plan, they also save your favorite tools and language so the site looks the same on any device; without a paid plan they are neither sent nor stored.
  • Open sessions (a random key of which we store only the fingerprint, with its expiry) and a security log of your account: the event type and the date, for example “password changed”, without an IP address.

What it does not store

We do not store your documents, their names, your digital certificates or the passwords of your files. We do not store your IP address in the accounts database: the server uses it only in memory to limit repeated attempts and then forgets it. There are no cookies, no analytics and no advertising, and we do not share account data with third parties.

Session in your browser, no cookies

When you sign in, the page stores in your browser's local storage (localStorage) a random session key and the public key your browser uses to check the signature of your plan. They are not cookies, they are sent only to this same site, and they are erased when you sign out. If you clear the site data, you will have to sign in again.

Purpose and legal basis

We use this data to create your account, keep your settings and prevent abuse. The basis is the service you ask of us when you create the account (GDPR article 6.1.b). The minimum age to create an account is 16.

How long it is kept

  • Account data, until you delete the account.
  • Sessions expire after 30 days without use and, at most, after 90 days.
  • Server error counters (day, error type and count, no personal data): 90 days.
  • When the account is deleted, the name, the email, the settings, the recovery code, the sessions and the security log are erased.
  • To prevent restoring a backup from recreating a deleted account, we keep a deletion list with an irreversible identifier (a fingerprint), with no name, email or IP. Backups are encrypted and rotated over time.

Your rights

From your account panel you can download all your data as a file (access and portability), change your password and email (rectification) and delete the account (erasure).

You can also object to processing or ask for it to be restricted by writing to hola@solo2.net, and if you cannot sign in, ask us to delete the account. If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

The account terms are on the terms page. Terms

Server logs

We do not keep access logs: the server does not record which pages are requested or from which IP address. The server only keeps the error log, which may include the IP address, with the system's default rotation. To prevent abuse, the server counts recent requests per IP address in memory; that counter is not written to any file.

If this changes

If analytics or anything else that touches your data is ever added, this page will say so before it reaches production, with what data and why.

Information on the website owner is in the legal notice, and third-party components downloaded by your browser, along with their licenses, are on the licenses page. Legal notice · Licenses

Back to home