NightOwl PDF
Privacy Policy
Last updated 30 September 2026
NightOwl PDF (“NightOwl”, “we”) is a PDF editor that runs in your web browser, at nightowlpdf.com. It is run by Tanmay Gaur in New Delhi, India. This policy explains what we collect, why, where it goes and what you can do about it. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.
- Your documents are opened and edited on your own computer. We never see them unless you save one to your account or use high-accuracy OCR.
- We collect only what running your account needs: your email address, your plan, and how many high-accuracy OCR pages you use.
- We do not sell your data, show ads, or use tracking cookies.
- To find bugs, we collect error reports, which never contain your documents. We do not record your sessions.
Your documents
When you open a PDF in NightOwl, it is read, shown, edited, recognised with the free OCR, compressed and exported inside your browser. It is not uploaded to us. A document leaves your computer in only two cases, both started by you:
- Save to account. The PDF and your work on it — markup, bookmarks, recognised text and corrections — are stored in your account so you can open them on another device. They are kept by Supabase, our database provider, in Mumbai, India, and only your account can open them. A saved document keeps the original PDF so that your work can be changed later: redacting it hides the words there, but only a file you export has them removed. Share the exported file, not the saved one. You can delete a saved document at any time from Saved files. When a file is saved, our server reads its first and last few kilobytes to check that it is a PDF, and keeps nothing it read; the rest of the file goes straight to Supabase.
- High-accuracy OCR. The page you choose is sent as an image, through our server, to Google Cloud Vision, which reads its text and sends it back. We do not keep the image. Google processes it under its Google Cloud terms.
What we collect about you
- Your account: your email address; your name and profile photo if you sign in with Google; when you signed up and last signed in.
- Your plan: whether you are on the free plan, the free trial or a subscription, and when it ends.
- Usage: how many high-accuracy OCR pages you use, and when. We record the number, not the pages.
- Free trial fingerprint: when you start the free trial, a code made from your email address with a secret key. It does not contain the address and cannot be turned back into it; it only lets us recognise the same address, including Gmail's variations of it, if it signs up again. Because it recognises you, we treat it as your personal data.
- Technical details: like every website, the services that deliver NightOwl receive your IP address and browser details when you visit.
Error reports: when something breaks, a report of the error, your browser and the steps just before it goes to Sentry: which kind of error, where in our code, and which buttons were pressed, never your documents, their names, what you type or the error's own message. It is not linked to your email address. We do not record your sessions.
Why we use it
To sign you in, keep your saved documents, give you what your plan includes, keep high-accuracy OCR within its allowance, prevent abuse such as repeated free trials, and reply when you write to us. We use your data only for these purposes, with the consent you give by creating an account, which you can withdraw by deleting it.
Who else handles it
These services process your data for us, only to provide their service:
| Service | What it does for NightOwl |
|---|---|
| Supabase | Sign-in, account details and saved documents, stored in Mumbai, India |
| Cloudflare | Delivers the website, passes high-accuracy OCR pages on to Google, counts visits without cookies (Cloudflare Web Analytics), and checks that a request for a sign-in code comes from a person rather than a program (Cloudflare Turnstile) |
| Google Cloud Vision | Reads the pages you send for high-accuracy OCR |
| Google Sign-In | If you choose it, shares your name, email address and photo with us |
| Resend | Sends our sign-in emails, and so holds your email address |
| Cashfree Payments | Takes payments, once online payment opens, and so receives your name, email address and phone number with each payment |
| Sentry | Receives error reports so that we can fix bugs |
| Google Fonts | Supplies the typefaces the site uses, and so receives your IP address |
Payments. Payments are taken by Cashfree Payments India Private Limited, a payment gateway authorised by the Reserve Bank of India, once online payment opens. When you pay, your name, email address and phone number go to Cashfree, which needs them for the payment and to meet RBI rules; you give your phone number at checkout, and we pass it on without keeping it. Card, UPI and bank details go to Cashfree only and never reach us. Cashfree handles them under its own privacy policy and the card industry's security standard (PCI DSS). From Cashfree we receive only what we need to give you what you paid for: whether the payment succeeded, the amount, the date, the payment reference and the kind of method used. We keep those payment records for as long as tax law requires, even if you delete your account.
Cookies and browser storage
We use no advertising or analytics cookies. Your browser keeps a sign-in token and a few settings so that you stay signed in. It also remembers the theme you choose (light or dark) and the names of your favourite and recently used tools, never a document, its name or its contents; these stay on your computer. If you sign a document, your browser also keeps a picture of that signature, so the next document takes two clicks: by default only when you are signed in, and otherwise only if you tick "Remember it in this browser". It stays on your computer and is never sent to us. Untick "Remember it in this browser", press "Forget saved signature", or sign out, and it is removed. If you use Google's sign-in button, Google sets its own cookies.
How long we keep it
Your account details, plan, usage and saved documents are kept while your account exists. A saved document you delete can no longer be opened or downloaded from that moment, and its files are erased straight away; if erasing is interrupted, for example by a lost connection, what is left is erased automatically, usually within the hour. A download already under way when you delete may still finish, and copies you downloaded or exported stay wherever you keep them: we cannot reach those. You can delete your whole account yourself, from the account menu: Account and subscription → Delete account. Your account, plan, usage and saved documents are erased straight away; copies in backups, and our providers' short-lived service logs, which may hold your email address, are gone within 30 days. We keep only records the law requires, such as payment records for tax, and the free trial fingerprint.
The free trial fingerprint is kept for two years from the day your trial started, even if you delete your account, so that the free trial is given once per person as our terms say. After two years it is deleted.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- ask what personal data we hold about you and how we use it;
- have it corrected, completed or brought up to date;
- have it erased, by deleting your account (Account and subscription → Delete account);
- withdraw your consent at any time;
- nominate someone to exercise these rights if you die or become unable to;
- complain to us, and if we do not resolve it, to the Data Protection Board of India.
Write to [email protected] from your account's email address, or by post to Tanmay Gaur, 216, Ghondli, Krishna Nagar, East Delhi, Delhi 110051. Other ways to reach us are on Contact us.
Security
Everything travels over an encrypted connection. Saved documents can be opened only by the account that saved them, enforced by the database itself, and are stored encrypted by Supabase. That is not end-to-end encryption: the service holding them could technically read them. We never open your saved documents; they are reached only by your account. NightOwl never asks for a password: sign-in uses one-time codes or Google. No system is perfectly secure; if a breach ever affects your data, we will tell you and the authorities as the law requires.
Children
NightOwl is for people aged 18 and over.
Changes to this policy
We will post any change here with a new date. If a change is significant, we will email you before it takes effect.
Grievance Officer and contact
Tanmay Gaur, Grievance Officer
NightOwl PDF, New Delhi, India
[email protected]
We acknowledge every complaint within 24 hours and aim to resolve it within 15 days.