How Lockpage handles your documents

When you open a tool, the browser loads the page and processing code from our domain — pdf.js (Mozilla) and pdf-lib. The chosen file is read into the tab's memory via the File API and processed on your CPU. The result is assembled there too and saved to disk as a regular download.

• Not a single byte of document content goes to the server. You can check this in the DevTools Network tab.
• Scripts and the pdf.js worker are served from our domain. Editor fonts are fetched through our server by name only — your document never leaves the browser.
• For the Free limit, before download the server receives only metadata: tool, mode, page count and size in bytes. Paid plans make this request too, but no limit applies.
• When you close the tab, document data disappears from browser memory.

A browser may run out of memory on a file of hundreds of megabytes or on a weak phone. For that, Pro and higher plans have cloud mode: up to 2 GB on Pro. It's turned on with a switch for one operation, not for the whole account.

1. 1You choose "Cloud" and see a warning: the file will be uploaded and deleted after 60 minutes.
2. 2The server creates a job with an expiry and processes the file. Source files are deleted right after processing.
3. 3The result can be downloaded until expiry — 60 minutes after upload. You can delete it earlier with one click.
4. 4Expired files are removed by background cleanup; the database keeps a service record of the job — without the file name or contents.

The retention period is a single configuration value and is the same for cloud mode and AI.

The server is needed for accounts, subscriptions, teams and limits. We designed the schema so it physically has no fields for file names or contents.

Retention: anti-fraud signals — 7 days, ad impression records — 90 days. Details in the privacy policy.

Free means 2 documents per day per device, not per email: otherwise the limit could be bypassed with a new address in a minute. To recognize a device without sign-up, the browser computes a SHA-256 hash of a set of characteristics: canvas rendering, graphics card vendor and model (WebGL), audio context, core count, memory, screen, time zone and installed fonts.

• The hash is computed on the device. The characteristics themselves are not sent to the server and can't be recovered from the hash.
• No third-party fingerprinting services. The hash is not shared with third parties or used for advertising or tracking on other sites.
• The server keeps a counter per "hash + /24 subnet" pair and, if you're signed in, per account.
• If many new devices come from one subnet, the browser gets a computational task (Proof-of-Work) for a few seconds. It doesn't block honest users.

There are no ads now. If they appear, they will only be Lockpage's own creatives and direct partners served from our server. No third-party ad networks, pixels or third-party cookies: any such script would get access to the page where your document is open.

• No behavioral targeting: creatives are chosen randomly by weight, not by your data.
• A view is confirmed by a one-time token on our server — so ads don't block downloads for people who watched honestly.
• No watermarks on Free. Paid plans have no ads.

AI tools are the only ones that always need a server. We made sure as little as possible is sent: the browser extracts text from the selected pages itself and sends only that. PDFs, images and file metadata are not sent.

• The text is processed by the Claude model from Anthropic — our subprocessor. We pass the text to the API and store neither the request nor the answer: only the text length is logged.
• Data retention on Anthropic's side is governed by its commercial API terms. We guarantee deletion on our side; on the provider's side, within our agreement with them.
• The interface shows a warning before sending. Documents with personal data are better redacted first.
• AI is available on paid plans and only to signed-in users.

• Passwords are hashed with bcrypt; the session is a signed token in a cookie with HttpOnly and SameSite flags.
• Payment goes through Stripe Checkout: card details are entered on Stripe's side; we only receive subscription status and invoices.
• API keys are stored as hashes; a revoked key stops working immediately.
• For Enterprise: an on-premise build in your network, cloud mode on your servers, SSO and a DPA.

• Redaction rasterizes the page

  A page where you redacted data becomes an image (200 dpi): its text can no longer be selected or searched, and links disappear. Other pages stay unchanged. Auto-detection can't see scans without a text layer — mark areas on them by hand.

• A signature is an image, not an electronic signature

  The Signature tool places a signature image and stamps. Certificate-based e-signatures (PAdES) are in development.

• Permissions in a password-protected PDF are a recommendation

  An open password (AES-256) protects reliably. Not all viewers respect print and copy restrictions.

• Your device must be clean

  Local processing protects against sending the file to us, but not against malware or browser extensions with access to all pages.

• Browser memory

  Very large files on weak devices may not fit in the tab's memory. Then cloud mode or the Enterprise on-premise build helps.

• Conversion to Word and Excel is basic

  Locally, text and simple tables are carried over; columns, images and complex layouts are not preserved.