Privacy Policy

Safha is a service provided by akkadX LLC, a company registered in Wyoming, United States. We are responsible for the data described in this policy, which covers the website, the Safha phone apps (Android and iPhone) and the desktop app. For anything privacy-related, contact [email protected].

Tools that run on your device

These tools carry an "On your device" badge. When you pick a file, it is read and processed on your device, in the browser or inside the app, and you save the result on your device. The file never leaves your device and nothing from it reaches us.

Tools that use our server

Some tools need software that doesn't run well in a browser, such as Office conversions, OCR and background removal. In some other tools only one specific option uses the server, such as the Strong level in Compress PDF. We say so on the tool, or next to the option, before you choose your file. The same rule applies when you use these tools from the apps.

When you use these tools:

1. Your file is sent to our conversion service over an encrypted connection (HTTPS).
2. The file is processed and the result is sent back to you.
3. Temporary files are deleted right after the result is sent to you, or as soon as processing fails. If a job file is left behind (for example, when the connection drops), an automatic cleaner removes it. Details are on our security page.

We don't log the contents of your files, keep copies of them, look at them, or use them to train any system or for any purpose other than doing what you asked.

Exporting a CV to PDF

When you export your CV from the CV builder to PDF or an image, on the website or in the app, the CV's content is sent to our server, which turns it into a file and sends it back to you. We keep nothing from this export. If you save the CV to your account, it stays there until you delete it or your account.

AI tools: Summarize PDF, Translate PDF and Ask your PDF

These tools use AI, and they only work when we turn them on on the server. When you use them, the text is extracted from your file and sent over an encrypted connection to our AI provider, Anthropic; its policy link and retention details are on our security page.

• What is sent to the provider: the text extracted from your file, not the file itself, with a size limit per request; the options you chose, such as summary length or target language; and your questions in Ask your PDF.
• What we keep: nothing after processing. Only Ask your PDF keeps the text in the server's memory, for up to 30 minutes, to answer your follow-up questions. It is never written to disk.
• At the provider: the provider handles the text under its own terms. Under its published policy it deletes inputs and outputs within 30 days, with the exceptions it lists, and its commercial terms say it does not train its models on customer content. We recommend not using these tools for highly sensitive documents, such as official IDs or medical reports.
• AI output can contain mistakes, so review it before you rely on it.

Reporting an inappropriate result: results from these tools carry a "Report an inappropriate result" option. A report carries only four things: the tool name, the reason you picked, the app version (or that it came from the website) and the language, which we store with the time of the report. A report never carries the document, its text or the result, nor your IP address or your account. If the app can't send it, it offers you an email to us with the same four fields.

We want to know which tools are useful and which need fixing, without tracking you. So we run our own analytics, stored in our own database and not sent to any advertising or third-party analytics company. We collect:

• A hashed token instead of your IP address: we turn your IP address and browser type into a token using a secret value that changes every day, and we never store the address itself. Because the value changes daily, your visits on different days can't be linked through this token.
• Country: taken from a header added by Cloudflare, the network the site runs behind. We don't determine your city or precise location.
• Device, browser and operating system type.
• The referring site, the pages you visit, how long you stay on them, and a random id per browser tab that disappears when you close it.
• Tool usage events: the tool name, whether it ran on your device or on the server, whether it succeeded or failed, how long it took, the number of files, and an approximate size range (for example "1 to 5 MB"). We never record file names or contents.

If you are signed in on the website, we link tool usage events to your account so you can see them on your activity page. When you delete your account we cut that link, and they remain anonymous numbers.

If your browser sends Do Not Track or Global Privacy Control, we don't record your visits or your tool use, except tool usage events tied to your account when you are signed in, and then without the visitor token, country or device type.

Retention: detailed visit and tool records are deleted automatically after 400 days, and the deletion job runs every 6 hours. After that only daily totals remain, such as how many times a tool ran on a given day, with no identifier at all.

Like any website, our servers and Cloudflare may keep short-lived technical logs, such as IP address, request time and the page requested, to run the service and protect it against attacks and abuse. These logs don't include the contents of your files, and we don't use them to build a profile of you.

An account is optional, and every tool works without one. You can create one and sign in with any of these:

• Email and password: we store your email and your password only as a bcrypt hash, which can't be turned back into the password.
• Google account: Google gives us your account id, your email and whether it is verified, and your name.
• Apple account: Apple gives us your account id and email, and your name if you share it. If you choose to hide your email, we receive the private relay address Apple creates, not your real address. We store the refresh token Apple issues encrypted with AES-256-GCM, so that we can ask Apple to revoke it when you delete your account.
• Passkeys: we store only the public key and a device name you can change. The private key, and your fingerprint or face, stay on your device and never reach us.

With your account we also store your name, language and chosen site appearance, your account role (member or administrator) and status, the time of your last sign-in, and a history of sign-in method changes (linking, unlinking, and passkeys added or removed). On the website, a signed session cookie keeps you signed in.

Site administrators can ban accounts that abuse the service, for example by trying to disrupt it or using it for illegal activity.

Some features need an account, such as saved workflows, signature requests and saved CVs.

Saved workflows

If you create a workflow that chains several tools, such as merge, then compress, then add page numbers, we save its settings in your account: the tools, their order and the options you chose. We don't save the files that pass through a workflow. Each step follows its own tool's rule: on-device steps run on your device, and server-step files are deleted right after processing.

This feature lets you ask other people to sign a document by email. Because a request passes through several people and can take days, this is the feature where we keep a document on our server for a while.

• What we store: the document you uploaded and its name; the signers' names and email addresses as you entered them; the signature images and fields the signers fill in; an audit trail showing the time of each action (such as opening the request or signing), with a hash of the IP address made with a secret value that changes every day and the browser and operating system type; and then the final signed document.
• Emails: we send each signer an email with their own link to sign in the browser. We don't store the link itself, only a hash of it. These emails are sent through the email provider Resend, and the feature only works when it is set up.
• Who can access the document: you, and the signers you added, through the links sent to them. We don't use the document for anything other than carrying out the request.
• How long we keep it: the signing link is valid for 30 days from when the request is sent, and signers can download the signed copy with their link for 30 days after the request is completed. The document and audit trail stay until you delete the request yourself or delete your account, and then we also remove its files from the server.

If you received a signing email from us, it's because the person who sent the request entered your name and email. For any question about your data in a signature request, email [email protected].

What stays on your phone

Local tools in the app run on your phone without internet, and the app sends no statistics about the screens you open or your use of local tools. The camera is used only when you choose to photograph a document or a portrait, and only the photos you pick are opened from your gallery; all of them are processed on your phone unless you run a server tool on them. App settings, such as the reminder frequency, are kept on your phone.

The anonymous install record

On every start of the app, and when you change your reminder settings or a new notification token is issued, the app sends our server (POST /api/devices):

• A random id for the installed copy, generated by the app and unrelated to who you are or to your account.
• The platform (Android or iOS), the app language and its version number.
• Your phone's time-zone offset from UTC, so we respect quiet hours.
• Whether notifications and reminders are on, and the notification token issued by Google or Apple, only if you allowed notifications and kept reminders on.

Along with it we store when the copy was first registered, the last time you opened the app, and how many reminders in a row you didn't open. We store no IP address, no name and no email, and we don't link this record to your account. The reminder frequency you choose stays on your phone and is never sent.

Why: to send notifications in your language and at a reasonable time, to stop them when you ignore them, and to target a notification at a given platform or version, such as an update notice.

How long: we delete this record automatically after 13 months in which the app is not opened, and it does not point to you. We remove the notification token from it when you turn reminders off in the app, on the first start after you turn notifications off in your phone settings, or when Google tells us the token is no longer valid (for example after you uninstall the app). After you uninstall the app, the record is never updated again.

Notifications and reminders

• Local reminders: the app schedules them on your phone itself, every 3 days by default or weekly, or you turn them off in Settings. Nothing from them reaches us.
• Notifications from our server: if you allow notifications, we send them through Google's Firebase Cloud Messaging; on iPhone, Google hands them to Apple's notification service (APNs). The server then takes over reminders from the local ones: at most one tip every 3 days, only if you haven't opened the app in that time, between 10 am and 9 pm your time, and we stop after 4 in a row that you didn't open. We may also send messages from our admin panel, such as a new feature or an update. A notification carries only a title, a text, a link inside the app and a campaign reference.
• Opening a notification: when you open one, the app tells our server (POST /api/push/opened) with the random id and the campaign reference. We use it to reset the unopened count to zero, update the last-activity time and add one to that campaign's open count.

You can turn notifications off at any time in the app's settings or in your phone settings.

Update check and service settings

A few seconds after start, the app asks our server for the latest available version (GET /api/app-version), sending only the platform and the app language, and we store nothing from that request. It also fetches general settings, such as whether the AI tools are on, and checks that the conversion service is available. These requests carry no data about you and no cookies.

The "My Documents" vault

A vault for your official documents, such as IDs and passports:

• It stays on your phone only: nothing in it is sent over the internet, and we have no way to reach it.
• Encrypted with AES-256-GCM: every document, its preview and the vault's index, with a key protected by the phone's system (Android Keystore or iOS Keychain).
• Excluded from backups and from device-to-device transfer.
• Fingerprint or face unlock is handled by the phone's system: we receive no biometric data, and the app only learns whether the check succeeded. You can also open the vault with its own 6-digit PIN. The app lock works the same way.
• Reading a document happens on your phone: text and machine-readable zone (MRZ) recognition run offline, with Apple Vision on iPhone and the ML Kit model bundled in the app on Android. We removed from the Android app the Google component that sends usage statistics in the background.
• Export is your call: if you export a copy of the vault, it is a file encrypted with a password you choose, and you decide where to keep it and who to share it with.

If you uninstall the app or clear its data, the vault goes with it, and we have no copy.

Signing in to the app

An account is optional in the app too. You can sign in with Google, with Apple on iPhone, or with a passkey. Your phone's system confirms your identity with Google or Apple, then the app sends the sign-in token to our server to open your account, and the rules in "Your account" apply. Your session is stored encrypted on your phone: with an Android Keystore key on Android, and in the iOS Keychain on iPhone, and it never moves to another device.

Deleting your account in the app

Open "Settings", then in the "Account" group tap "Delete my account" and confirm. Your account is deleted from our servers at once, exactly as on the website, and the app signs out. Files saved on your phone and the vault's contents stay as they are, because they were never with us.

• Local first: local tools run on your computer without internet. You open and save files through the system's own dialogs; the app keeps its settings and recent-files list on your computer and clears its temporary files, and anything left after a crash is cleared on the next start.
• No analytics, no account: the app sends no usage statistics and doesn't offer sign-in at the moment.
• Connectivity check: the app tries to open a connection to our server (safhapdf.com) to know whether the tools that need the internet are available, without sending any data about you or your files.
• Server tools: they connect to the same server as the website, or open the tool's page in your browser, and the rules in "Your files" apply.
• Updates: on start, and when you ask it to check, the app fetches the latest release information from safhapdf.com. No update is installed without your confirmation, and you can turn off the automatic check in Settings.
• Offline pack (optional): if you ask for it, the app downloads LibreOffice (to convert Office files to PDF) and Tesseract (for text recognition) from a fixed address on the akkadx.com domain built into the app, and checks them against a SHA-256 hash. After that these tools run on your computer without sending your files to any server.

On the website we currently use strictly necessary cookies only:

• Session cookie: keeps you signed in, only set if you sign in, and expires after 30 days.
• Language preference cookie: remembers your preferred language.
• Short-lived sign-in cookies: one protects the Google or Apple sign-in step for 10 minutes, and one remembers for 30 minutes after you create an account that we should suggest saving a passkey.

We currently use no advertising cookies and no third-party tracking cookies. Full details, including how to delete cookies, are in our cookie policy.

You can install Safha from your browser as an app on your computer or phone. Your browser then saves the site's own files, such as pages and code, in a cache on your device (the Service Worker cache), so on-device tools keep working offline once loaded. This cache doesn't store your files, and you can remove it by uninstalling the app or clearing the site's data in your browser settings.

Website notifications are optional, and your browser only asks about them when you click "Notify me about important updates" after a tool finishes or on your account page. If you agree, we store the notification token Google (Firebase Cloud Messaging) issues for your browser, a random id for this browser and the interface language, without your IP address. We link this to your account only if you subscribe while signed in, and then it is deleted with the account. We use it only for messages from our admin panel, such as an important update, never for automatic reminders, and when you click a notification your browser tells our server so we can count opens. To stop, click "Turn off notifications" in the same place and we delete the subscription at once, or block notifications in your browser's site settings. The subscription is also deleted automatically after 13 months without activity.

• We don't sell your personal data.
• We don't show ads targeted at your activity.
• We don't share your data with advertisers.

We rely on service providers that process data on our behalf and only to run the service:

• Contabo GmbH: server hosting; its address range is registered in Germany.
• Cloudflare: content delivery and protection; every request to the site passes through it.
• Anthropic (AI provider, see our security page): it receives your file's text only when you use an AI tool, and only while those tools are turned on.
• Google (Firebase Cloud Messaging): delivers notifications to the phone apps and to your browser, if you allow them.
• Apple: delivers notifications to iPhone, and Sign in with Apple if you choose it.
• Google: Sign in with Google if you choose it.
• Resend: sends signature-request emails to signers, and only when that feature is set up.

We may also disclose data if the law requires it, or to protect the service and its users against fraud and abuse.

Data may be processed and stored in countries other than yours, depending on where our service providers' servers are located.

• Your files in server tools: deleted right after the result is sent to you, or as soon as processing fails.
• Text in AI tools: we don't keep it after processing, except in Ask your PDF, where it stays in the server's memory for up to 30 minutes. The provider handles it under its own terms.
• CV export: we keep nothing from it.
• Signature requests: the document, signer details and audit trail are kept until you delete the request or your account.
• Send files (when the feature is available): files are stored encrypted and deleted automatically when the link expires, after 1 or 3 days without an account and at most 7 days when you are signed in, or sooner if you delete the transfer or its download limit is reached. A "Request files" link stays open for 7 days at most. The record of a deleted transfer, without its files, is kept for 30 days to handle abuse reports, then removed.
• Workflows and saved CVs: until you delete them or your account.
• Detailed statistics: 400 days, after which only daily totals remain, with no identifier.
• Technical logs: for a limited time, for security and to run the service.
• Website sign-in session: 30 days.
• Account: until you delete it.
• App install record: deleted automatically after 13 months in which the app is not opened, and it does not point to you. The notification token is removed from it as described under "Phone apps".
• AI result reports: deleted automatically 24 months after they are sent, and they carry nothing that points to you.
• The vault and the apps' local files: on your device, until you delete them or the app.

• Deleting your account: delete it yourself at any time, from "My account" on the website or from the app's settings. It is deleted at once, together with your workflows, saved CVs, the signature requests you sent and their files, and your linked sign-in methods, and every session ends. If you linked an Apple account, we first ask Apple to revoke the sign-in token it issued to us. The full steps, and the list of what is deleted and what stays, are on the delete your account and data page.
• If you can't sign in: email [email protected] from the address registered to your account; we confirm the account is yours, then delete it.
• Correction: change your name and language on "My account"; for anything else, email us.
• Access and portability: ask for a copy of your account data at [email protected].

We will never ask for your password, by email or any other way.

We use an encrypted connection (HTTPS) on the website and in the apps, store passwords only as bcrypt hashes, and delete server-tool files right after processing. No method of protection on the internet is perfect, but we design the service so that as much of your work as possible stays on your device in the first place. Details are on our security page.

The service is not directed at children under 13, and we don't knowingly collect personal data from them. If you learn that a child has created an account, contact us and we will delete it.

We may update this policy when we add tools or features or when the way the service works changes. We will change the "last updated" date at the top of the page, and if a change is significant we will point it out clearly on the site.

For any privacy question or a request about your data:

akkadX LLC, Wyoming, United States Email: [email protected]