Irfan PDF

Privacy policy

Two different things are described here: the Irfan PDF desktop application, and this website. Both are small on purpose. Everything stated below was read from the project files or from a code scan dated 2026-10-16; where a claim could not be checked, the page says so.

A. The Irfan PDF application

Nothing leaves your machine

  • The application’s local server binds to 127.0.0.1 only — reachable from this computer and from nothing else.
  • A grep across the server and interface code on 2026-10-16 for HTTP clients, telemetry, analytics and error-reporting services returned zero matches: no telemetry, no analytics, no external HTTP calls.
  • OCR, conversion, search, comparison and the document analysis tools all run locally with bundled models and libraries. The analysis module contains no API key, no URL and no network call — a test enforces that.
  • The shipped test report records that no paid or network service is required by the software.

Where your data lives

Everything is stored in the application’s own data folder, next to the program — never in a cloud and never in a user profile path:

  • data\files — your documents and everything generated from them;
  • data\backups, data\state, data\models, data\output, data\jobs, data\temp;
  • data\logs — operational logs; data\settings.json — your preferences.

Deleting that folder removes the data. Paths derive from the application folder and can be relocated with IRFAN_PDF_HOME.

Accounts (optional, off by default)

Sign-in starts switched off: there is no account to create, no email address collected, no cloud service. If several people share a machine, an administrator can switch sign-in on in Settings → People. Passwords are stored only as salted PBKDF2-HMAC-SHA256 with 600,000 iterations (the plaintext is never written anywhere), a wrong password and an unknown user return the same message, and sign-in is rate limited to five failures per username per five minutes. Switching sign-in off again keeps the accounts local.

Logging

What the logs contain — and what was not audited

The application writes a rotating operational log to data\logs\irfan-pdf.log (5 × 2 MB). The project states that job failures are logged with their tracebacks and that nothing logs document content. The exact field list of every log line and of the exported diagnostic report has not been independently audited for this page — Cannot verify beyond the project’s own statement. Read a log before you share it.

No third parties, no automatic updates

  • The application talks to no third-party service: no analytics vendor, no CDN, no font or icon host — the interface ships with its own inline assets.
  • There is no updater. Nothing in the project files downloads or installs a new version; updating is a manual download, as described in Installation.
  • Local protections include a Host-header check against DNS rebinding, an Origin guard that refuses cross-site writes (403/415), a 512 MB request ceiling and nosniff / SAMEORIGIN / no-referrer headers.

B. This website

  • No cookies. The site sets none.
  • No analytics and no third-party trackers — no tag manager, no pixel, no embedded third-party scripts. Fonts and icons are inline, so the pages load without contacting anyone.
  • One localStorage entry: ipdf-site-theme, holding your light or dark choice. It stays in your browser, is not sent anywhere, and clearing site data removes it.
  • When hosted: the web server’s standard access logs apply — the usual record of IP address, requested page, time and user agent. Which provider hosts this site, and that provider’s retention policy, Cannot verify from project files until the site is deployed.
  • Download links are only produced from a configured base URL; no placeholder or third-party download host is ever substituted.

Data we never see

  • Your documents — their content, their names, the pages you open and the tools you run on them.
  • Anything written inside them: names, addresses, account numbers, medical or legal details.
  • Your application sign-in passwords — they are hashed locally and never transmitted.
  • Your conversions, edits and searches — they happen on your machine and stay there.

The one way data can leave your machine

You send it yourself — by attaching a health report or a log to a support request, or by sharing a file you produced. The contact page says what to include and what to withhold.

Next: Security · Terms of use · FAQ