Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains what information PDF to PNG (“we”, “us”, “our”) collects, how we use it, and who we share it with. It replaces every earlier version of our privacy policy, including the one hosted on Google Docs.

What this policy covers

Three things, together called the “Services”:

the PDF to PNG Chrome extension, which turns the pages of a PDF into PNG images;
the Save Image as PDF – PNG to PDF Converter Chrome extension ("Save Image as PDF"), which saves images from web pages and from your computer as PDF files;
the website pdf-to-png.app: its PDF to PNG and PNG to PDF converters, this page, and the welcome page the PDF to PNG extension opens once, right after you install it.

Our principles

Privacy policies should be human readable and easy to find.
Data collection should be as small as the job allows. Your files are the job, and they never leave your device.
Data practices should meet the reasonable expectations of users. Where the extensions and the website behave differently, this page says so, and every analytics event is named below.

The short version

Your files are never uploaded. Your PDFs, your images and the pages and pictures made from them are read and converted by your own browser. We have no server that could receive a file.
We measure how the Services are used with PostHog, an analytics service. The events say what happened (for example “a PDF was saved: 3 pages, A4”) and never contain your files or what is in them. The extensions never send file names or the addresses of pages you visit, and the website keeps file names out of its recordings and click events (see Session recording).
Where the law asks for consent, you are asked first. In the European Union, the rest of the European Economic Area, the United Kingdom and Switzerland you see a banner with Accept and Reject. In Russia the Services act as if you had pressed Reject. Everywhere else, including the United States, analytics are on by default and no banner is shown. Your region is looked up from your IP address, or guessed from your time zone when that fails (see below).
No accounts, no payments, no advertising, and we do not sell your data.

Information you give us directly

There are no accounts, no purchases, no payments and no newsletters. You give us information only when you choose to:

email us at arto@pdf-to-png.app: we receive your email address and what you write;
rate an extension with one to three stars in its rating prompt, which opens a feedback form (four or five stars open the extension's review page on the Chrome Web Store instead);
answer the short survey Chrome opens after you remove either extension.

The feedback form and the survey are Google Forms. The extensions open them as plain links with nothing added to the address: of this, a form receives only what you type into it, and nothing if you close it (Google, like any site, also sees the connection itself: your IP address and, if you are signed in to Google, your account). Google hosts the forms under its own privacy policy. Reviews on the Chrome Web Store are public and follow Google's rules.

What the extensions do with your files, on your device

PDF to PNG

PDF to PNG reads a PDF only when you ask it to:

the PDF shown in the tab where you click the extension's toolbar icon or choose it from the right-click menu;
a PDF you open, drop or paste into its side panel;
a PDF saved on your computer and open in a tab, and only if you have turned on "Allow access to file URLs" for the extension in Chrome's settings.

To read the PDF shown in a tab, the extension runs a small script inside that tab. The script takes the PDF from the copy your browser already holds or, when there is none, downloads it again from the site that serves it, the same way the tab did. The side panel then draws the pages, and each PNG is saved through Chrome's downloads. The PDF is kept in memory only while the side panel shows it; nothing of it is written to the extension's storage.

Two permissions are asked for only when they are needed:

Access to one site. If Chrome does not let the extension read a PDF from its tab, the side panel offers a button. Only when you press it does the extension ask Chrome for access to that one site (for example https://example.com). The access stays, so you are not asked again, until you remove it in Chrome's settings for the extension. It is used only to read PDFs you ask the extension to convert.
Downloads. Saving several pages as separate files asks Chrome for permission to manage downloads. Saving them as one ZIP file needs no permission.

On your device, PDF to PNG stores your settings (the output width, whether batches are saved as separate files or one ZIP, which tips you have seen), the state of its rating prompt, the running totals described under the events, your analytics answer, the install id described below, PostHog's own working data, and, for the current browser session only, a note of how the side panel was opened in each window.

Save Image as PDF

Save Image as PDF reads an image only when you ask it to:

an image you right-click and save with “Save image as PDF”;
images you drop, paste, choose with “Choose images”, or drag from a web page into its side panel.

With an image it may also read the image's alternative text, the file name the site gives it, and the title of the page, which names the PDF when the image's address has no usable name.

To get an image you right-clicked or dragged in from a page, the extension downloads it from the site that serves it, from your browser, using the image's own address. No server of ours is involved. The PDF is written on your device by the extension's own code and saved through Chrome's downloads.

Access to one image site. The extension declares optional access to all sites (the *://*/* pattern) because it cannot know in advance which site will serve an image, but it never asks for that at install, and most images download without it. When a site does not let extensions read its images, the extension shows a page, or a row in its side panel, that names that one site, with a preview of the image loaded from that site (except in Incognito windows). Only when you press Allow does it ask Chrome for access to that one host (for example images.example.com). The access stays, so you are not asked again, until you remove it in Chrome's settings for the extension. It is used only to download the images you choose from that site.

On your device, Save Image as PDF stores:

the collection: the images you add to its side panel, with their names, sizes and order, up to 50 images, kept (also across Chrome restarts) until you save them into a PDF, remove them, or clear the collection;
your settings (what a right-click does, the page size) and the state of its rating prompt, including how many PDFs you have saved;
your analytics answer, the install id described below, PostHog's own working data, and usage events waiting to be sent (at most 2,000 events, 1 MB, and 30 days old);
for a short time only: while a question about site access is open, the image's address and the page's address and title (used for up to 10 minutes, deleted the next time the extension starts, and in any case when Chrome closes); for an image dragged in from a page, its address, alternative text and name (up to 30 minutes, dropped the next time the side panel updates, and in any case when Chrome closes); the name of the last PDF saved from a right-click until the side panel or the problem page has shown it, and of the last PDF saved from the side panel until Chrome closes; an SVG image while it is turned into pixels; and a finished PDF on its way to Chrome's downloads.

Both extensions

Your files, what is in them, and their file names never leave your device through the extensions. Removing an extension from Chrome deletes everything it stored on your device.

What the extensions send: usage analytics

Both extensions share the same analytics code and send usage events to PostHog, our analytics service provider, on its EU cloud (eu.i.posthog.com). Apart from the sites you ask them to read a PDF or an image from, the forms, store pages and pages of this website you open yourself, and the welcome page PDF to PNG opens once after you install it (see The welcome page), PostHog is the only place the extensions send anything.

The region check, before any answer

Every time an extension page opens (the side panel, and Save Image as PDF's permission and problem pages), it asks PostHog which consent group applies to you. PostHog works out your country from the IP address of that request. The request carries your IP address, the address of the extension page that asked (such as chrome-extension://…/sidepanel.html) and, unless you have rejected analytics, the extension's install id (as both its user id and its device id). After a Reject it carries neither. No usage event is sent until there is an answer, yours or the automatic one below. If PostHog does not answer within five seconds, the extension guesses on your device from your browser's time zone: European time zones, and time zones that name no country such as UTC, get the banner; Russian time zones count as a Reject; all others count as an Accept.

The European Union, Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland: a banner asks you to Accept or Reject. Until you answer, nothing but the region check is sent, and if you never answer, nothing is. What you did while the banner waited is sent once you answer: up to 20 events from an extension page, and Save Image as PDF's right-click events (those up to 30 days old after an Accept, with the install id; up to 60 hours old after a Reject, without it).
Russia: no banner; the extensions act as if you had pressed Reject.
Everywhere else, including the United States: no banner; the extensions act as if you had pressed Accept.

The answer, yours or the automatic one, is stored in the extension and is final: the banner is not shown again, even if you travel. The extensions' banner says "We use cookies for analytics."; the extensions set no cookies, and keep their state in the extension's own storage on your device.

What an event contains

Each event has a name, a few properties of its own, and the standard technical properties PostHog adds to every event: your browser and its version, your operating system and its version, the device type, the full user-agent string, the browser's language, the screen and window size, your time zone and the version of PostHog's code. Events sent by an extension's own pages also carry random session and window ids that change with each browsing session (not after a Reject); Save Image as PDF's events queued by its background worker carry none. We add which extension sent the event and its version. Events sent by an extension page also carry that page's own address inside the extension (such as chrome-extension://…/sidepanel.html), never the address of a website.

PDF to PNG: every event it sends

panel_opened: The side panel opened: how it was opened (for example the toolbar icon or the right-click menu, and which menu), whether a PDF was found in the tab, and whether Chrome gave the extension access to the tab.
tab_detect_result: What the extension found when it looked at the tab, as a category (for example a PDF, no PDF, or a page Chrome does not let extensions read), how many frames of the page it could look into, and yes or no answers such as whether a local PDF is waiting for Chrome's file access switch. Never the address of the page.
tab_autoload_result: Whether reading the PDF from the tab worked, as a category; the file size; whether it came from the browser's cache, the network or a local file; and categories of the site's answer (for example "404" or "5xx", and whether it may be cached).
permission_requested: You answered Chrome's question for an optional permission: which one (access to the PDF's site, or downloads) and whether you allowed it. Never the name of the site.
file_settings_opened: You pressed the button that opens Chrome's settings for the extension, to allow access to PDFs on your computer. Nothing else.
pdf_loaded: A PDF opened: the number of pages, the file size, how it was opened (from the tab, the file picker, drag and drop, or paste), whether a file you opened yourself has a different name from the PDF in the tab (yes or no, never the names), and how many password attempts it took (a number, never the password).
pdf_load_failed: A PDF could not be opened: the reason as a category (damaged, password protected, too large, or unknown) and the file size.
png_saved: A page was saved as a PNG: the page number, the number of pages, the width in pixels and the width setting, the size of the PNG, and how many pages you have saved from this PDF.
png_save_failed: Saving a page failed: the reason as a category, and the width.
selection_changed: You changed which pages are selected: how (clicking pages, the page range field, or Select all), how many are selected, and the number of pages.
batch_save_clicked: You started saving several pages: how many of how many, all or selected, separate files or one ZIP, the width, and which button started it.
batch_save_completed: A batch finished: how many pages and files, how long it took, how many pages failed, and whether it finished, partly finished or was stopped.
batch_save_failed: A batch failed: the reason as a category, how many pages, how many were already saved, and the width.
batch_save_cancelled: You cancelled a batch: how many pages, and how many were already saved.
batch_delivery_switched: You switched a batch between separate files and one ZIP.
batch_folder_opened: You opened the downloads folder after a batch. Nothing else.
rating_link_opened: You clicked a star in the rating prompt: the number of stars, and how many saves you have made so far.
rating_dismissed: You closed the rating prompt: how many saves you have made so far.
consent_response: You answered the analytics banner: Accept or Reject.

Every PDF to PNG event also carries five running totals the extension keeps on your device: how many times its side panel has opened, how many PDFs opened and how many failed to open, and how many saves worked and how many failed (a batch of pages counts as one save).

Save Image as PDF: every event it sends

menu_used: You chose "Save image as PDF" from the right-click menu: what a right-click does in your settings (download, collect, or collect and show), whether it opened the side panel, and whether it fell in the early period when a right-click opens the panel to show you around.
pdf_saved: A PDF was saved: the number of pages, the page size (image size, A4 or Letter), whether it came from a right-click or the side panel, whether any image had to be redrawn (anything but a plain JPEG), and whether any image had transparency.
save_failed: A save stopped: the step where it stopped (download, decode, drawing, embedding, layout, saving or collecting), which problem page you were shown, and whether it started from a right-click, the side panel or the permission page.
collection_changed: The side panel's collection gained or lost an image: the number of images in it.
host_permission: You answered Chrome's question for access to an image site: whether you allowed it. Never the name of the site.
panel_intake: Images came into the side panel: whether they were dropped, dragged from a page, pasted, or chosen with the file picker.
panel_opened: The side panel opened: after a right-click, from the toolbar icon, or because of the "Collect & show" setting.
rating_link_opened: You clicked a star in the rating prompt: the number of stars, and how many PDFs you have saved so far.
rating_dismissed: You closed the rating prompt: how many PDFs you have saved so far.
consent_response: You answered the analytics banner: Accept or Reject.

PostHog's code adds two events of its own: $opt_in, when analytics are turned on, and $feature_flag_called, which records the answers of the region check. Heatmaps are switched on in our PostHog project, so the extension pages also send $$heatmap events: where you clicked and moved the mouse on the extension's own pages, and the window size.

Never in any event: your files or anything in them, file names, page text, images, passwords, or the address or title of any web page, PDF or image, or the name of any site. The extensions record no page views and make no session recordings, and apart from the heatmaps above they do not record clicks automatically.

The install id

Each extension creates a random identifier for itself, the install id, and stores it on your device. If you accept, or analytics are on by default where you are, events carry this id, and PostHog keeps a profile for it built from its events. The id is not linked to your name, your email address or your Google account, and the two extensions do not share one. Removing and reinstalling an extension gives it a new id.

If you Reject

Events are still sent, but without the install id and without any cookie. PostHog counts them with a hash of your IP address and browser details, mixed with a value that changes every day, so PostHog cannot join events from different days into one visitor, and no location is added to them. Two exceptions, both in PDF to PNG: its events still carry the running totals described under the events, which are read from your device, so a sequence of them could be matched up by those numbers; and a PDF to PNG side panel that was already open in another window when you pressed Reject keeps sending with the install id until it is closed.

Errors

Save Image as PDF sends no error reports: when a save fails it sends only the save_failed event above. PDF to PNG hands errors it catches (for example a PDF that cannot be opened) to PostHog's error reporting. A report holds the error's type and message and the places in the extension's code where it happened, and nothing from your files.

Location

PostHog receives your IP address with every request, as any server you connect to does, and uses it to find your country for the region check. The IP address itself is not stored: our project discards it. Before discarding it, PostHog looks up your country from it, and only the country (with its continent) is kept with the events of people whose analytics are on: region, city, postal code and coordinates are removed before anything is stored. Events sent after a Reject carry no location. Every event also carries your browser's time zone.

The website pdf-to-png.app

Your files

The PDF to PNG and PNG to PDF converters work like the extensions: your browser reads your files and makes the images or the PDF on your device. Nothing is uploaded. The website is a set of static files, and there is no server of ours that could receive a file. The PDF to PNG page remembers, in your browser's local storage, whether you prefer batches as separate files or one ZIP; that preference stays in your browser.

Hosting

The website is hosted by Netlify. Like any web host, Netlify receives your IP address and the details of each request (the address of the page, your browser, and the page that linked to it) in order to deliver the pages.

Analytics on the website

The website uses the same PostHog project and the same consent groups as the extensions. In the banner regions it shows a banner that reads "We use cookies to understand how you use the site and improve it. Your files never leave your device regardless of your choice.", with Accept and Reject.

Before you answer, the website makes the same region check, which carries your IP address, a random id created by the page and details of the page you are on, and it may download PostHog's settings and code from PostHog's servers. No event is sent, nothing is recorded, and no cookie is set.

When your analytics are on, the website records:

page views and page leaves: the address of the page on pdf-to-png.app, including any campaign tags in it (such as utm_source), the page that linked you to it, and how far you scrolled;
clicks, recorded automatically: when you click a button, a link or another clickable part of a page, or change a field, the event records that element's text and attributes and those of the elements around it. What you type into a field is never included. Several quick clicks in one spot are also recorded as a “rage click”;
our own events, all from the PDF to PNG page and the banner (the PNG to PDF page sends none of its own):
pdf_loaded
A PDF opened: the number of pages, the file size, how it was opened (the file picker, drag and drop, or the sample PDF), and how many password attempts it took (a number, never the password).
pdf_load_failed
A PDF could not be opened: the reason as a category, and the file size.
png_saved
A page was saved as a PNG: the same properties as in the extension.
png_save_failed
Saving a page failed: the reason as a category, and the width.
selection_changed
You changed which pages are selected: how, how many are selected, and the number of pages.
batch_save_clicked
You started saving several pages: the same properties as in the extension.
batch_save_completed
A batch finished: the same properties as in the extension.
batch_save_failed
A batch failed: the same properties as in the extension.
batch_save_cancelled
You cancelled a batch: the same properties as in the extension.
batch_delivery_switched
You switched a batch between separate files and one ZIP.
consent_response
You answered the cookie banner: Accept or Reject.
errors in the website's code, reported automatically with their type, message and the places in the code where they happened;
PostHog's $opt_in and $feature_flag_called events, as in the extensions;
a session recording, described below.

Website events carry the same standard technical properties as the extensions' events, plus the website's version. While your analytics are on, they also carry a random id kept in a cookie (see Cookies and storage), and PostHog keeps a profile for that id, as it does for an install id. The website also sends heatmap data (where you click and move the mouse) and measurements of how fast its pages load. Clicks that had no visible effect are not recorded.

Session recording

Session recording is switched on for the website and is not sampled, so any visit with analytics on can be recorded. A recording is a reconstruction of the page as you saw it, not a video of your screen: the layout of the page and the text on it, mouse movements, clicks, scrolling and the window size, plus the messages the page writes to the browser's developer console. Recording never runs before you answer, and never after a Reject.

What is hidden from recordings:

everything you type into any field, and the password field for a protected PDF, which is left out of the recording entirely;
the name of every file you open: on the PDF to PNG page, the PDF's name and each page picture (with its description, which names the file); on the PNG to PDF page, each image's thumbnail and its name, and the error message (which can name a file). All are left out of recordings entirely, and a click on them sends no click event. The Move up, Move down and Remove buttons next to an image are recorded and their clicks are sent, but they refer to the file's name without containing it;
the pages of your PDFs and your images: the page shows them from addresses that exist only inside your browser, and recordings do not copy the pictures.

Cookies and storage

Before you answer: no cookie.
If you accept, or analytics are on by default where you are: PostHog sets one first-party cookie, named ph_ followed by our project key and _posthog, which holds the random id and the current session. It lasts up to 365 days and is renewed when you come back. PostHog also keeps working data in your browser's local and session storage.
On the PDF to PNG page, two settings of its own in local storage, whatever you answered: how you like a batch of pages delivered (batch_delivery_preferences) and whether you have saved a batch as separate files before (batch_files_priming_done). Neither leaves your browser.
Your answer, Accept or Reject, is kept in your browser's local storage under __ph_opt_in_out_ followed by our project key.
If you Reject: no PostHog cookie; events are sent without one, counted the same way as for the extensions (see If you Reject), and nothing is recorded.

There are no advertising cookies and no other analytics on the website.

The welcome page

Right after you install PDF to PNG, the extension opens pdf-to-png.app/install/ once. That page shows no banner and sends one event, extension_installed: it records that the page was opened, with a fixed note that the install came from the Chrome Web Store. It carries the standard properties and no cookie or stored identifier, and PostHog counts it the same way as events sent after a Reject. The page turns off automatic click recording, page views, heatmaps, performance measurements and session recording. The page loads its font from Google Fonts, so Google receives your IP address and browser details, and it loads PostHog's code from PostHog's servers.

How we use information

to see which features are used and how often, and where converting or saving fails, so we can fix problems and decide what to build next;
to decide which consent banner, if any, to show you;
to count installs and returning users;
to answer your messages and read your feedback.

We do not use any of it for advertising, we do not sell it, we do not combine it with other information about you, and we do not use it to determine creditworthiness or for lending.

Chrome Web Store User Data Policy

The use of information collected by the PDF to PNG and Save Image as PDF extensions complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. In practice:

the extensions use the data only to provide and improve their single purpose (turning PDF pages into PNG images, and saving images as PDF files) and to keep them working reliably;
the data is transferred only to PostHog, the service provider that runs our analytics, for that purpose; or where the law requires it; or, if the Services are ever sold or merged, only after we have asked for your explicit consent;
it is never sold, never transferred to advertising platforms or data brokers, never used for advertising of any kind, and never used to determine creditworthiness or for lending.

Service providers: these are all of them

If a service is not on this list, the Services do not use it.

PostHog: analytics for both extensions and the website, on PostHog's EU cloud. See PostHog's privacy policy.
Netlify: hosts the website.
Google: Google Forms for the feedback form and the removal survey, Google Fonts on the welcome page, and the Chrome Web Store, where you install the extensions and can leave a review. See Google's privacy policy.

Legal compliance

We may disclose information if the law requires it, or where it is reasonably necessary to protect the rights, property or safety of our users, the public, or us.

Business transfers

If the Services ever change hands, information they collected will be transferred only after we have asked for your explicit consent. Nothing stored on your device is ours to transfer.

At your request

We may share your information with someone else if you ask us to.

Legal basis for processing

Where the law requires us to state one, our legal grounds are:

consent, for analytics tied to an id in the regions where the banner asks for it; see Your choices for how to withdraw it;
legitimate interests, for the region check, for analytics in the other regions, for the counting that follows a Reject, and for answering your messages: measuring and fixing the Services, in ways that do not override your rights and freedoms.

Your choices and rights

In the extensions

In the banner regions, you choose Accept or Reject.
There is currently no setting inside the extensions to change a stored answer, and outside the banner regions no switch to turn analytics off. Removing an extension stops it from sending anything and deletes everything it stored on your device; if you install it again, it gets a new install id and, in the banner regions, asks again.
Site access you granted can be removed at any time in Chrome's settings for the extension.

On the website

In the banner regions, you choose Accept or Reject. To change your answer, clear the site data for pdf-to-png.app in your browser; in the banner regions the banner then shows again.
A content blocker that blocks PostHog stops the website's analytics, and the converters keep working.

Access, correction and deletion

You can ask us what we hold about you, and ask us to correct or delete it, by writing to arto@pdf-to-png.app. The install id and the website's id are random and not linked to your name, so to find your data we need that id; write to us and we will explain how to look it up. Events sent after a Reject carry no id we could look up, so they cannot be found or deleted one by one.

If you are in the European Economic Area, the United Kingdom or another place with similar laws, you may also object to or restrict our processing and withdraw your consent, and you can complain to your data protection authority. We encourage you to contact us first, so we can resolve your concern quickly.

International transfers

PostHog keeps our analytics on its EU cloud. Netlify and Google may process data in the United States and other countries, under their own safeguards for international transfers.

Security

The most effective protection we have is not holding your files at all: there are no uploads and no accounts. The analytics data lives with PostHog, protected by its security measures and by access limited to us. No internet transmission is completely secure, and we cannot guarantee against every unauthorized attempt to access information.

Children

The Services are not directed at children under 13, or under 16 where the EU GDPR sets that age, and we do not knowingly collect personal information from them. If you believe a child's information is in our analytics, write to us and we will delete what we can find.

Data retention

On your device: as listed above. Removing an extension deletes all it stored. The website's cookie lasts up to 365 days, and its local storage stays until you clear it.
At PostHog: events for up to one year and session recordings for 30 days. The profile PostHog keeps for an install id or the website's id stays until we delete it, which we do on request.
Emails: kept as long as needed to answer you, and deleted on request.

Third-party links and services

The Services link to other sites, including the Chrome Web Store, Google Forms, and the privacy policies named above. Those sites follow their own privacy policies, not this one.

Changes to this policy

We will post any changes on this page and update the date at the top.

Questions about this policy

Questions, requests, or anything on this page that looks wrong: arto@pdf-to-png.app.