Privacy and security

Your files stay on your device

Collated is a web page that does all its work in your browser. There is no server that receives your files and no account. The page's security policy lets it talk only to its own site, never to anyone else's. (Our automated tests fail if it ever tries.) The only things it sends are an anonymous page-view count and a count of exports, with no cookies and never anything about your files; the privacy notice lists exactly what that records.

What the site does download, the first time you need it: the code that reads PDFs, HEIC photos and TIFF scans, the 4 MB of text-recognition data for searchable text, and the 6 MB that Auto-rotate pages uses to tell which way up a page is. These come from Collated's own site, and the host can see they were fetched, but not what you used them on.

The privacy notice has the full detail, including what is kept on your device.

What goes into the PDF

Only what you see on the pages, and what you chose to add:

• No photo metadata. Phones store the camera, the time and often the GPS location inside each photo. Collated removes all of it before the image goes into the PDF; the picture itself is unchanged.
• No hidden parts. If Fill or scaling hides part of an image, that part isn't stored.
• Blacked-out areas are removed, not covered. Pixels under a box are painted over before the image is stored, a PDF page with a box goes in as a picture of the page, and searchable text leaves out words under a box. See Black out part of a page.
• PDF pages bring only what they show. Filled-in form fields, stamps, signatures and highlights are drawn onto the page as they look; the form data behind them, comment text, attachments, scripts and the original file's metadata are left out, and so are images from pages you removed. A PDF page with a hidden layer is exported as it looks, as an image, so nothing hidden comes with it. Its own text can't be selected, but Make text searchable reads it from that image. Anything a PDF page draws outside its visible area is still there, clipped (as it was in the original).
• Searchable text, only if you turn it on.
• Bookmarks, only if you add them: the section names you type and, with Bookmark each imported file on, your files' names.
• The title you gave, "Collated" as the creating tool, and the date (without the time of day).

Your work is kept on this device

So that a reload, a crashed tab or a phone closing the page in the background doesn't lose your work, Collated keeps a copy of the document in your browser's storage on this device as you go: the files, the pages, your settings and the undo history. It never leaves the device, and the password is never part of it. Next time you open Collated it asks Restore your last document?: Restore brings it back, undo history and all; Discard deletes it. If you add files instead, they start a new document, which replaces the saved one.

On a shared computer, or if you'd rather nothing were kept, turn off Keep work after a reload in the toolbar's More menu; that deletes the copy and stops keeping one. A very large document may not fit in the space the browser allows; Collated says so, and then keeps nothing, so export before you close the tab.

Signatures

A signature you save is kept in your browser on this device, in its own storage, apart from your document, and never uploaded. Delete one under Saved when you next sign, or clear the site's data in your browser to delete them all. A signature you put on a page is part of that document, so it's also in the copy of your work kept on this device until you start over. See Filling in and signing a page.

Passwords

A password encrypts the PDF's content with AES-256. The filename and the page count aren't hidden. Collated keeps the password in memory while the page is open and never stores it, not even with the copy of your work kept on this device; closing or reloading the tab forgets it.

The password of a PDF you add is used once, in your browser, to open it, and then forgotten. What Collated keeps, with the rest of your work on this device, is an unlocked copy of that PDF: anyone who can use this browser can see those pages, as with any other file you added. To lock what you export, set Password to open.

Starting over

Pages you remove stay in the page's memory so Undo can bring them back. On a shared computer, Start over in the toolbar's More menu clears everything at once: the pages (removed ones too), the undo history, recognised text, the password and the copy kept on this device. It can't be undone. Your page setup is kept.

Open source

The source code is public (MIT licence), so all of this can be checked. Security problems: please open an issue, or report it privately through GitHub's security advisories.