Files and anonymous jobs
FitPDF stores uploaded PDFs, derived previews, and results in a private job directory. A random capability token protects each job; only its SHA-256 hash is stored. Files expire 15 minutes after the job is created, and reruns do not extend that time. Delete now removes the original and every result immediately.
Logs and analytics
The MVP does not intentionally log document content, extracted text, capability tokens, or original file names. No third-party analytics or advertising SDK is configured.
Operational metadata
Minimal job metadata may include timestamps, byte counts, target bucket, processing status, mode, and non-content error codes. Production retention and abuse-prevention periods must be approved before public Beta.
Open production decisions
TODO before public Beta: identify the legal operator, contact address, hosting provider, processing region, subprocessors, error-tracking provider, analytics provider (if any), international transfer basis, and the final retention schedule. This page must receive legal review after those selections.