PaperLumo
Create workflow

Find your PDF tool

Certificate Sign PDFSign a PDF locally with your own P12 or PFX certificate.Smart Form AssistantRead portal instructions, review requirements and prepare upload files.QR Mobile TransferSend a document from your phone to a computer with a private QR code.Photo & Signature CleanupClean signature ink, paper shadows and plain photo backgrounds locally.PDF ActionsDescribe PDF steps, review the plan and run them on your device.Form-upload packPrepare your photo, signature and documents in one download.Compress to target sizeAim for 100 KB, 200 KB or your own PDF upload limit.ID card sheetPlace front and back images neatly on one A4 sheet.Submission checkerCheck size, pages and likely blanks before you submit a PDF.Batch PDF recipesClean, number or watermark a batch. Rename and download one ZIP.Invoice to ExcelExtract invoice fields, review the evidence and export Excel.HTML to PDFTurn an HTML file or pasted markup into a readable PDF.PDF to PDF/ACreate a PDF/A-2b document with independent conformance validation.Create PDF formsAdd interactive text fields, checkboxes and dropdowns to your PDF.Smart privacy reviewFind sensitive-data candidates, review boxes and permanently redact.Word to PDFConvert DOCX documents into PDFs with text, images and page layout.Excel to PDFConvert XLSX documents into PDFs with text, images and page layout.PowerPoint to PDFConvert PPTX documents into PDFs with text, images and page layout.Scan to PDFTurn document photos into clean PDFs. Adjust corners, contrast and page order.OCR PDFTurn scanned pages into searchable PDFs with English and Hindi OCR.Protect PDFEncrypt your PDF with a password using AES-256 protection.Unlock PDFRemove PDF password protection using the password you know.Repair PDFTry to recover a readable PDF by rebuilding its document structure.PDF to ExcelExtract selectable PDF text into rows and cells in an Excel workbook.Merge PDFBring your PDFs together. In exactly the right order.Split PDFA few pages or every page. Keep just what you need.Compress PDFLess file size. More room for what matters.PDF to WordTurn PDF text into an editable Word document.JPG to PDFYour images, neatly wrapped in one PDF.Edit PDFAdd and position text, images, shapes and drawings directly on PDF pages.Sign PDFDraw, type or insert a signature image, then position it on your PDF.Organize PDFReorder pages until everything falls into place.PDF to JPGMake every PDF page a shareable image.Watermark PDFAdd your name. Protect your point of view.Rotate PDFGive sideways pages a fresh perspective.Page numbersKeep everyone on the same page. Literally.Extract pagesKeep the pages you want in a brand-new PDF.Delete pagesLose the extra pages. Keep the good stuff.Crop PDFTrim the margins. Bring the important bits closer.PDF to PNGCrisp, lossless images from your PDF pages.PDF to TextJust the words. Ready to copy, search or reuse.PDF to MarkdownGive your notes and knowledge base a head start.PDF to PowerPointPut your PDF pages into a presentation.Compare PDFCompare text or highlight visual page changes between versions.Redact PDFRemove a sensitive area from the exported pages.Flatten PDFTurn interactive forms into a finished document.Fill PDF formsComplete existing form fields in a few clicks.Remove metadataClear the details your document carries along.Edit metadataGive your PDF the right title and author.Resize PDFA4, Letter or Legal. The right fit, every time.Reverse pagesFlip the page order from back to front.Duplicate pagesMake room for another copy of the useful bits.Grayscale PDFA simpler palette for print-ready pages.Inspect PDFPage sizes, metadata and form fields at a glance.Text to PDFTurn a plain text file into a tidy PDF.PNG to PDFKeep your screenshots together in one PDF.Image to WebPLighter images, happier websites.Image to JPGMake your images easy to open, anywhere.Image to PNGLossless image files for your next project.Resize imageThe perfect dimensions, without the guesswork.Compress imageCut image weight before you hit send.
Only tool preferences are saved. Never your files.Tab navigate Enter open
YOUR FILES ARE YOUR BUSINESS

Private, by the way it works.

Most PDF and image tools process documents in your browser. Office-to-PDF, HTML-to-PDF and PDF/A conversion use a temporary server upload, only after you select the upload checkbox and start conversion. The optional AI assistant sends reviewed, extracted text to the provider named in the tool only with your confirmation.

Catalogue links, Challenge Rooms and response packs

These tools read PDFs locally. Reviewed source text and, for response checking, your prepared response are sent to the named AI provider only with your confirmation. Publishing a catalogue or quiz requires an account and separate sharing confirmation. Published text, source excerpts and an optional catalogue WhatsApp number are accessible to anyone with the link. Original PDFs are not published. Links are unlisted and marked noindex; this is not access control.

Catalogue links expire after 30 days and quiz rooms after 24 hours. Owners can unpublish links earlier. Expired records and guest submissions are removed when experience API traffic next triggers cleanup; database backups may retain earlier copies under the backup policy. Account deletion removes owned experiences. Stored catalogue/quiz content is encrypted at rest. Guest nicknames, answers and scores are stored in the database; nicknames and final scores are visible in the room. Guest access tokens are stored in sessionStorage on that device and hashed on the server. Public experience paths are excluded from our analytics. Exported drafts contain source excerpts and should be kept privately.

What happens to your documents

For browser-local PDF and image tools, the file you choose is read into browser memory. Processing and rendering happen on your device. Downloads are created locally. Closing the tab releases the working session; your original files and any downloads stay wherever you saved them.

Temporary conversion uploads

Office, HTML and PDF/A conversion files are uploaded to this site and processed by its dedicated LibreOffice worker. PDF/A outputs are also checked by veraPDF. HTML scripts and external resources are removed. These files are not sent to an external AI provider. The worker deletes temporary input, output and profile files after processing, including ordinary errors and cancellation. After a crash, stale scratch directories are swept after one hour while the worker is running. No conversion history or permanent result URL is stored.

The PDF download is held in browser memory after conversion. Avoid sensitive uploads on shared or untrusted deployments. Hosting operators control their own logs, disk snapshots and backups; this code does not guarantee secure disk erasure.

Temporary encrypted QR transfers

QR Mobile Transfer encrypts one PDF or image on your sending device using AES-GCM. The encryption key is included in the private QR link fragment and is not sent to the server. The server holds encrypted bytes in process memory for at most ten minutes, or until the receiving browser requests deletion. A server restart clears transfers. Receiving and decryption occur in your browser. The private link permits one upload; keep it private. This is not a malware scanning service. Hosting operators still control their infrastructure and logs.

What this site stores

Optional MCP developer service

MCP is a remote service: documents are uploaded with your permission and held in bounded server memory. File access expires after ten minutes; expired buffers are swept every thirty seconds while the process runs. Deleting a file or restarting the server clears it sooner. MCP document bytes are not stored in the account database or its backups. Office conversion also uses the temporary worker described above. PaperLumo MCP does not send documents to an AI provider, but your own MCP client may share tool inputs and outputs with its model provider.

API keys are stored as hashes and shown only at creation. Account-linked key labels, prefixes, expiry and last-use times are stored for access control. Operation IDs, input fingerprints, tool names, credit usage, status and output file IDs are retained for retry handling and accounting; records older than 90 days are removed during MCP maintenance while the service runs. Do not put personal information in key labels or operation IDs. Database backups can retain deleted metadata for up to seven days. The developer dashboard is excluded from page analytics. Revoke keys in the dashboard, delete temporary files through MCP, and use Team Workspace for account deletion.

Optional accounts, teams and signature requests

Team Workspace stores your chosen username, password hash, hashed recovery code, session cookies, memberships and requests in PostgreSQL. No email address is required; usernames are self-declared and are not verified identities. Authentication uses essential HttpOnly session cookies for up to seven days and records security metadata such as IP address and browser headers. Keep recovery codes private; losing both your password and recovery code can make the account unrecoverable.

Team PDFs are uploaded only after confirmation and encrypted at rest in the application database. Authorized team members and anyone holding a valid recipient link can access the shared request. Files become inaccessible after seven days and are removed by hourly cleanup while the service runs. Request titles, hashes, signer-entered names and audit events are retained for up to 90 days. Owners can remove teams and their data; editors can delete requests. Deleting an account also removes teams it owns. Daily database backups on the hosting server are retained for up to seven days, so deleted records can remain in those backups until they expire. Backups are restricted operational copies, not publicly downloadable documents. Infrastructure logs and backups are controlled by the hosting operator; deletion is not a guarantee of physical disk erasure.

Cloud account connections

Optional Google Drive and Dropbox connections store OAuth tokens encrypted in your account. Drive access uses the drive.file scope for app-authorized files; Dropbox uses its app folder. Requested transfers pass through server memory. Disconnecting removes stored tokens and attempts provider revocation; if revocation fails, revoke PaperLumo in the provider settings. Cloud-provider copies remain in your cloud account until you delete them there.

Local certificate signing

P12/PFX files, private keys and certificate passwords are processed in a temporary browser worker and are not uploaded. The signature includes certificate identity information and the signing time; anyone receiving the signed PDF can inspect those details. This site does not issue certificates, verify legal identity, check certificate revocation or obtain trusted timestamps.

The optional offline toolkit saves only its app scripts, icons and styles in browser Cache Storage. Documents and outputs are never added to that cache. Use Remove saved toolkit to clear it. Only the four tools listed in that toolkit work offline.

Favorites, recently used tool names and saved workflow steps are stored in localStorage on this browser. Document contents, document names and passwords are not saved there. Clearing site data in your browser removes these preferences.

Core local tools require no account. This site has no advertising pixels. Optional Google Analytics is described below. The hosting provider receives ordinary page requests, including IP addresses and request headers, according to its logging configuration. This is separate from document processing.

Optional Google Analytics and cookies

We use Google Analytics 4 only after you choose Allow analytics. Reject analytics is equally available, and every tool works without analytics consent. Before consent, the Analytics script is not loaded and no Analytics measurement requests are sent. Advertising storage, advertising user data, personalization and Google signals remain disabled.

After consent, Google receives page visits to known public pages, page titles, cookie identifiers, loading-speed and responsiveness measurements (LCP, INP and CLS), and technical browser/device information. Team, signature-request, cloud, certificate-signing and QR pages are excluded from Analytics. Requests also expose your IP address to Google for processing. We send only recognized search-engine referrer origins, without their paths or queries. We exclude document contents, filenames, passwords, entered form values, site-search terms, URL query parameters and fragments. Automatic form, outbound-link, search and file-download measurement is disabled.

Optional tool measurement records a fixed tool identifier, starts, successful processing, download clicks, continuation clicks and coarse processing/cancellation categories. If you choose to send optional task feedback, we also record a fixed helpful/needs-improvement response, without free text. Duration is grouped into ranges; raw error messages and file properties are excluded. A download click does not confirm that a file was saved to your device. We ask for consent again when introducing this expanded measurement. Files passed to another local tool stay in this tab's memory, are consumed by the selected tool and are never included in analytics.

The first-party cookies _ga and _ga_MEJHY5S0YN distinguish visits and sessions. We configure a maximum 180-day cookie lifetime without extending it on each visit. Your consent choice is stored in localStorage for up to 180 days. Analytics user/event retention is configured to two months; aggregated reporting may be retained longer. Google may process data outside your country. See Google’s privacy policy and how Google uses information from partner sites.

Use Analytics preferences in the footer to change or withdraw consent. Rejecting stops future measurement and removes this site’s Analytics cookies; it does not undo data already received by Google. You can also clear this site’s browser data or use Google’s Analytics opt-out add-on. Analytics is limited to paperlumo.com and is disabled on temporary previews.

Advertising and document content

PaperLumo currently serves no advertising and does not load AdSense scripts or set advertising cookies. Allow analytics is permission for the measurements described here, not consent to advertising. Document contents, filenames, answers, contact details and private links are not sent to an advertising service.

If advertising is introduced, we will update this notice with the actual providers, data uses and consent controls before loading their code. Our current analytics banner is not an advertising consent platform. See our advertising standards.

Resources and connections

Fonts, PDF libraries, processing engines and English/Hindi OCR models are served from this site and downloaded when needed. Passwords are used in memory for Protect and Unlock PDF; they are not sent to our server. The optional AI assistant sends extracted text to this server and then to the AI provider named in the tool after you explicitly confirm. This app does not persist the submitted text or AI results. Cancelling does not undo text already received by the provider. Office conversion uses this site’s dedicated worker, as explained above. Additional planned capabilities are listed on our roadmap.

The current AI provider is Groq. Groq says ordinary inference inputs and outputs are not retained by default, but may be logged for system reliability or abuse investigations for up to 30 days, or longer where legally required. Usage metadata is retained. Groq states that retained customer data is stored in the United States. Read Groq’s data policy. The free account has token and request limits. This site does not automatically switch to a paid model when a limit is reached.

Understand each tool’s limits

Removing metadata is not the same as sanitizing a whole document. Cropping hides content but does not delete it. Redaction rebuilds the document as images and does not carry over the original text layer. Review exported pages before sharing sensitive information.

Editing can invalidate an existing digital signature. Typed signatures are visible marks, not certificate-backed signatures or identity verification. We do not claim ISO certification, a compliance audit, or protection from a compromised browser or device.

Your controls

The operator is Vyzonek Technology Private Limited, Patel Nagar West, New Delhi, Central Delhi - 110008, India. Contact legal@viraldm.app for privacy requests or use our grievance contact. Browser-local files are not held by our server; delete your own downloads or browser site data on your device.

Use tools without creating an account. Remove selected files from the workspace, close the tab to end the session, and clear browser site data to remove saved preferences. You remain responsible for the files you download and share.