Developer docs: Security & privacy
Reference
Security and privacy
What the script does and doesn’t do, how files stay in the visitor’s browser, Content Security Policy settings and self-hosting.
Where files go
Nowhere outside the visitor’s browser. The script passes the file to a PDFkind window in the same tab, the window reduces it on the visitor’s device, and passes it back. Your form then sends it to your server, as it always did.
What the script does, and doesn’t
| It does | It doesn’t |
|---|---|
| Listen for files picked or dropped where you set a limit, and nowhere else. | Upload files to PDFkind or anywhere else. |
| Open the PDFkind window for files over the limit and HEIC photos. | Read your other form fields or your cookies. |
| Let the original file through when it can’t help, after 8 seconds at most. | Set cookies or show ads, on your page or in its window. |
The script is under 10 KB and readable: pdfkind.com/embed.js. Inside the window and embedded tools we count anonymous uses, without cookies, to know which tools are used.
Content Security Policy
If your site sends a Content-Security-Policy header, allow PDFkind for scripts and frames:
Content-Security-Policy: script-src 'self' https://pdfkind.com; frame-src https://pdfkind.comHosting the script yourself
Copy embed.js to your server if you want to review every change before it reaches your site. It keeps using pdfkind.com for the tools. Copies don’t update by themselves, so check this page now and then.
<script src="/js/pdfkind-embed.js" defer></script>Data protection
Because files are processed on the visitor’s device and never sent to PDFkind, PDFkind receives no personal data from the files. Your obligations for the files your form receives don’t change.
Last updated November 3, 2026 · Questions: contact@pdfkind.com