Cookies policy

1. What is a cookie?

A cookie is a small text file (typically 50–300 bytes) that a website stores on your device. The next time your browser visits the same site, it sends the cookie back — that’s how a website remembers things between page loads, like which language you picked or whether you’ve accepted the privacy banner. Cookies don’t contain document content, they don’t run code, and they can’t access files on your device.

Cookies have two main flavours:

• First-party cookies are set by the site you’re actually visiting (in our case, by pdfluna.com). They’re the original cookie design and the kind your browser allows by default.
• Third-party cookies are set by a domain different from the page you’re on — usually because that page loads resources (ads, analytics scripts, embedded videos) from another company that wants to know who’s seeing them. Modern browsers (Safari, Firefox, Brave) block third-party cookies by default; Chrome is in the process of deprecating them.

Some technologies serve a similar purpose without technically being cookies (web storage, IndexedDB, browser fingerprinting). PDFluna doesn’t use any of those for tracking purposes; the only browser-storage we touch is cookies (and the small amount of localStorage certain tools use to remember your last-picked options, which never leaves your device and is documented inline on each tool page).

3. Types of cookies explained

The pills in the table above colour-code each cookie by type. The legal categorisation matters because different rules apply (consent required for analytics + advertising in EU/UK; not required for strictly necessary).

• Strictly necessary cookies are essential for the site to function as you’d expect. Without them, basic features break. They don’t require consent under GDPR/ePrivacy because consent isn’t the legal basis — they’re necessary for the service the user explicitly requested. Our only strictly-necessary cookie is pdfluna_consent, which records your choice on the consent banner.
• Analytics cookies count visitors and measure how the site is used (which tools get opened, roughly which countries we get traffic from, browser/device breakdown). Data is aggregated and anonymised. EU/UK users see a banner before these are set; reject and we fall back to cookieless Plausible.
• Advertising cookies support Google AdSense, which serves the display ads on tool pages and funds the site. EU/UK users see a banner; reject and ads run as non-personalised (which still set a small subset of advertising cookies for fraud prevention, but not for personalisation across other sites).

4. How we ask for consent

Visitors from the European Union, the United Kingdom, and the European Economic Area see a consent banner on first visit. The banner is operated by Google’s built-in CMP (Consent Management Platform), which is certified for IAB’s Transparency & Consent Framework v2 (TCF v2) and complies with the GDPR — we use Google’s CMP because it’s the same one that integrates natively with AdSense, removing the consent-double-handling problem that custom CMPs run into.

Visitor location is detected from your connecting IP address via Cloudflare’s CF-IPCountry request header. We don’t see or store the IP itself for this purpose — the country code is surfaced as a string at the edge.

Visitors from other jurisdictions get the default-consent flow, which is legal in those jurisdictions but means analytics + advertising cookies are set without an explicit prompt. If you’re in one of those regions and would prefer the EU-style banner, you can simulate it by blocking third-party cookies in your browser; the same end-state is achieved.

To re-open the banner and change your earlier choice, click “Cookie preferences” in the footer of any page. Your new choice replaces the old one (the pdfluna_consent cookie gets re-written) and propagates to all subsequent page loads.

5. Managing cookies in your browser

Browser-level cookie controls override anything we do on our side. If you block all cookies for pdfluna.com in your browser, you won’t see the consent banner (because we can’t set the cookie that records your acknowledgement) but the tools themselves still work — they don’t need cookies to run.

Each major browser’s vendor maintains official, up-to-date instructions for managing cookies. Browser UIs change often enough that we link rather than transcribe:

• Google Chrome
• Mozilla Firefox
• Apple Safari (macOS)
• Apple Safari (iOS)
• Microsoft Edge
• Brave

The general pattern across all of them: Settings → Privacy → Cookies, then choose to block third-party cookies, all cookies, or specific sites. Most modern browsers also have an “Erase site data when I close the browser” option that wipes everything a site stored when you close the tab.

6. Do Not Track and Global Privacy Control

Two browser-level signals exist for telling sites you don’t want to be tracked:

• Do Not Track (DNT) — an older signal supported by Firefox, Safari, and Edge. Most ad networks chose to ignore it after the standard didn’t finalise; Apple removed Safari’s DNT toggle in 2019 because of that.
• Global Privacy Control (GPC) — the modern replacement, supported by Firefox, Brave, DuckDuckGo, and via extensions in Chrome/Edge. Recognised under California’s CCPA/CPRA as a valid opt-out signal, and increasingly under EU national laws too.

What we do: we honour both signals. If your browser sends DNT=1 or GPC, we treat it as if you’ve rejected the consent banner — analytics falls back to cookieless Plausible and ads run as non-personalised. The signal is checked on every page load.

7. Opting out of analytics

Three ways to stop your visits from being counted in our anonymous analytics, in order of preference:

1. Reject the consent banner. Easiest path; the _ga cookies aren’t set in the first place, and we fall back to cookieless Plausible (which uses no persistent identifier of any kind).
2. Install the official Google Analytics opt-out add-on: tools.google.com/dlpage/gaoptout. Available for Chrome, Firefox, Safari, Edge. Once installed, GA4 is blocked from collecting data on every site you visit, not just ours.
3. Block googletagmanager.com in your browser or DNS. The most aggressive option — uBlock Origin and most DNS filters (NextDNS, Pi-hole) handle this by default.

None of these affect the tools themselves — PDF processing runs entirely in your browser whether GA4 is loaded or not.

8. Opting out of personalised ads

Personalised ads use a profile that Google maintains across sites you visit (not just ours). To opt out of personalisation while still seeing ads:

• Google’s My Ad Center: myadcenter.google.com. Switch off “Personalised ads”; you’ll see generic ads thereafter on Google and on every site that uses Google ads (including ours).
• EDAA (Europe): youronlinechoices.eu — umbrella opt-out covering most ad networks operating in Europe.
• NAI (US): optout.networkadvertising.org — Network Advertising Initiative opt-out.
• DAA (US): optout.aboutads.info — Digital Advertising Alliance opt-out, the WebChoices tool.

To stop ads entirely, install a content blocker (uBlock Origin, AdGuard, Brave’s built-in shield) or block third-party ads at the network level via NextDNS / Pi-hole / similar. Note that the site is supported by ad revenue; blocking ads is your right, and we don’t restrict access for ad-blocked visitors.

9. Mobile device controls

Phones and tablets have OS-level advertising controls that supplement browser cookies:

• iPhone / iPad: Settings → Privacy & Security → Apple Advertising → turn off “Personalised Ads”. For app-level tracking, App Tracking Transparency (ATT) prompts you on a per-app basis to allow or deny tracking; declining prevents the app from getting your IDFA (advertising identifier).
• Android: Settings → Google → Ads → turn on “Opt out of Ads Personalisation” and tap “Delete advertising ID.” This stops apps from receiving a stable identifier across sessions.

These settings affect mobile apps; for browser visits to pdfluna.com on iOS Safari or Android Chrome, the relevant controls are the browser’s cookie settings (section 5) plus the OS-level tracking controls listed above.

10. Third-party cookies and cross-site tracking

One cookie in our inventory is third-party: IDE, set by doubleclick.net when AdSense is loaded. Google uses it to measure ad effectiveness across sites that show its ads. If you accept personalised advertising in the consent banner, the cookie is set; if you reject, it isn’t.

Modern browsers are increasingly hostile to third-party cookies:

• Safari blocks them by default since 2020 (Intelligent Tracking Prevention).
• Firefox blocks them by default since 2019 (Enhanced Tracking Protection set to “Standard”).
• Brave blocks them by default at install time.
• Chrome is in the process of deprecating them as part of the Privacy Sandbox initiative.

In all of those scenarios, our advertising cookies stop being set regardless of what the consent banner says — the browser’s block runs first. We don’t use any of the “cookie bypass” tricks (CNAME cloaking, first-party-disguised tracking) that some sites use to circumvent browser blocks.

12. Changes to this policy

We update this policy when the cookie inventory changes — new cookie added, existing cookie removed, type or duration changed. The “last updated” date at the top reflects the most recent meaningful change; minor copy edits don’t bump it.

Substantive changes that affect what data we collect or set get a banner on the homepage for 30 days. Continuing to use the site after a change counts as acceptance of the updated policy; if you don’t accept, you can clear our cookies via your browser controls (section 5) and stop visiting.