Cookie Policy
Last updated: July 27, 2026
The short version
- DocFather sets no cookies. Not one. We checked with a real browser against the live site and the cookie jar was empty on every page.
- What we do use is browser storage: a few small values that keep you signed in and remember that you closed the notice at the bottom of the page.
- There is no advertising, no cross-site tracking and no profiling anywhere on this site.
- Because none of this needs your permission under the ePrivacy rules, the bar at the bottom of the page tells you what happens rather than asking you to choose. There is nothing to switch off, so we do not pretend to offer switches.
Why this page talks about more than cookies
Cookies are only one of the ways a site can keep something on your device. The others are called localStorage, sessionStorage and IndexedDB, and European law treats all of them the same way. So rather than write a cookie page that would truthfully say "none" and tell you nothing useful, we list everything DocFather puts in your browser, whatever it is called.
What DocFather stores
These belong to docfather.com. Everything here is needed to run the site, with one exception that is marked and explained.
| Name | Where | How long | Type |
|---|---|---|---|
df-auth Remembers that you are signed in, so every page can show "My account" instead of "Sign in" without loading the whole sign-in library. The value is the single character 1. It holds no name, email or identifier. Set by DocFather | localStorage | Until you sign out or clear site data | strictly necessary |
df-cookie-notice Remembers that you dismissed the cookie notice at the bottom of the page, so it does not come back on every visit. Set by DocFather | localStorage | Until you clear site data | strictly necessary |
df-google-redirect Set only if you sign in with Google and your browser blocks the popup, so we fall back to a full-page redirect. It lets the sign-in page tell "just came back from Google" apart from a normal visit. Set by DocFather | sessionStorage | Until you close the tab | strictly necessary |
firebase:authUser:… and firebase:persistence:… Your actual signed-in session: the account record and the token used to keep you logged in between visits. Without it you would be signed out on every page load. Set by Google Firebase Authentication | IndexedDB, database firebaseLocalStorageDb | Until you sign out or clear site data | strictly necessary |
firebase:redirectUser:… and firebase:pendingRedirect:… Carries your sign-in across the redirect to Google and back. Written only on the redirect path, cleared as soon as the sign-in completes. Set by Google Firebase Authentication | sessionStorage | Until you close the tab | strictly necessary |
__sak A capability probe. The sign-in library writes one character and deletes it to find out which kind of storage your browser permits, then uses that one. Set by Google Firebase Authentication | IndexedDB, localStorage and sessionStorage | Written and deleted again immediately | strictly necessary |
validate-browser-context-for-indexeddb-analytics-module Another capability probe, checking that IndexedDB can be opened at all. Listed here because the name alarms people: despite containing the word "analytics" it is not analytics and Firebase Analytics is not installed on this site. Set by Google Firebase | IndexedDB, empty database | Opened and deleted again immediately | strictly necessary |
firebase-heartbeat-database The one item on this page that is not strictly necessary. Google's sign-in library records which version of itself it is running, one short record per day, and attaches that version string to sign-in requests. It records no identifier, no page views, no referrer and no country, and for a visitor who never signs in it is never sent anywhere. We cannot switch it off without dropping Google sign-in, so we disclose it instead. Set by Google Firebase | IndexedDB | Rolling window of at most 30 daily records | analytics |
What other companies store
Two things are placed by someone other than us, and only when you actually start signing in. Neither appears if you just use the free tools.
| Name | Where | How long | Type |
|---|---|---|---|
cf.turnstile.u The human check on the sign-in page. It loads only after you choose the email sign-in link, never on an ordinary page view, and it lets Cloudflare recognise repeated challenge attempts from the same browser. It lives in Cloudflare's own storage area, which this site cannot read. Set by Cloudflare Turnstile | localStorage, inside Cloudflare's own frame | Until you clear site data | strictly necessary |
__Host-GAPS Set by Google, on Google's own domain, the moment you click "Continue with Google" and their sign-in screen opens. It secures that sign-in flow. This is the only cookie anywhere in this audit, it is not ours, and docfather.com cannot read it. Set by Google | Cookie on accounts.google.com | About 13 months | strictly necessary |
About analytics
DocFather runs no analytics product on this website. There is no Google Analytics, no advertising pixel, no session recorder and no heatmap tool. If you open your browser's network panel on a tool page you will see requests to docfather.com and nothing else.
One honest caveat, which is why the table above has an amber row. Google's sign-in library
keeps a short daily note of its own version number in a storage area called
firebase-heartbeat-database, and attaches that version to sign-in requests.
It is measurement, so we label it analytics rather than flatter it. What it is not is
tracking: it holds no identifier for you, no record of the pages you visited, no referrer
and no location, and if you never sign in it is never sent anywhere. It arrives with Google
sign-in and cannot be separated from it, so we disclose it instead of hiding it.
The DocFather iOS app is a different matter and is covered by the Privacy Policy rather than this page: it uses TelemetryDeck for app analytics, which records events without an advertising profile and without an advertising identifier.
How to delete this data
Clearing site data for docfather.com removes everything in the first table at once. You do not need to contact us and nothing is kept on our side.
- Chrome: Settings, Privacy and security, Third-party cookies, See all site data and permissions, search for docfather.com, then Delete.
- Safari: Settings, Privacy, Manage Website Data, search for docfather.com, then Remove. On iPhone: Settings, Safari, Advanced, Website Data.
- Firefox: Settings, Privacy and Security, Cookies and Site Data, Manage Data, search for docfather.com, then Remove Selected.
- Edge: Settings, Cookies and site permissions, Manage and delete cookies and site data, See all cookies and site data, search for docfather.com.
Every browser also has a setting that blocks this storage in advance, and any private or incognito window discards all of it when you close the window.
What breaks if you clear or block it
- The free file tools keep working. Merging, splitting, converting and compressing need no account and no storage. The five image converters, such as JPG to PNG, run entirely inside your browser and never upload anything at all.
- You get signed out. Removing the sign-in storage ends your session, and the header goes back to showing "Sign in". Your account, credits and vault documents are untouched: sign in again and everything is where you left it.
- Signing in stops working if you block storage entirely. Sign-in has nowhere to keep the session, and the Cloudflare human check on the email-link option cannot complete.
- This notice comes back. The bar at the bottom returns on your next visit, because the only record that you closed it was the one you deleted.
Changes
If we add anything that stores data in your browser, it goes in the tables above and the date at the top changes. If we ever add something that genuinely needs your consent, you will get a real choice rather than this notice.
Questions about any of this: [email protected].