Cookie Notice

KovaPDF sets three cookies, one of them only during a Google or Microsoft sign-in. All are strictly necessary, none tracks you, and there is no advertising or analytics cookie anywhere on the site. This page lists them in full — what they hold, how long they last, and what breaks if you block them.

01Why there is no cookie banner

A consent banner exists to obtain permission for cookies that are not necessary — the advertising, profiling and cross-site measurement kind. KovaPDF does not set any of those, so there is nothing to ask permission for, and a banner would be theatre.

The cookies below are strictly necessary: without them the service cannot enforce its usage limits or keep you signed in. Under the ePrivacy rules and equivalent laws elsewhere, cookies of that kind do not require consent — but they do require this: a clear, complete, honest explanation of what each one is. That is what this page is.

02The complete list

Three cookies, and this is all of them — two on every visit, and a third only for the moment you sign in with Google or Microsoft. If you inspect the site and find one not listed here, we have made a mistake — please tell us at support@kovapdf.com.

pm_anonStrictly necessary12 months

A randomly generated identifier given to every browser, signed in or not. It carries no meaning of its own — it is not derived from anything about you, and outside our rate counter it is a meaningless string. Its only job is to let the hourly operation limit recognise repeat requests from the same browser. It is set HttpOnly, so page scripts cannot read it, and SameSite=Lax, so it is not sent on cross-site requests.

pm_sessionStrictly necessary24 hours

Set only when you sign in. It holds a session token so that you stay signed in between page loads. Only a hash of the token is kept on our side, so the stored record cannot be turned back into a usable session. It is HttpOnly and Secure — script cannot read it and it is only ever transmitted over an encrypted connection. Logging out revokes the session on the server as well as clearing the cookie.

pm_oauth_stateStrictly necessary10 minutes

Set only when you choose to sign in with Google or Microsoft, and only for the few seconds that takes. It holds a random value that is checked when the provider sends you back, which is what stops another site from completing a sign-in on your behalf. It is HttpOnly and expires after ten minutes whether or not it was used.

03What is not here

The site sets no cookie for any of the following, because none of these are present at all:

Advertising, retargeting, or ad-conversion measurement.
Cross-site tracking or identity resolution across other websites.
Third-party analytics suites that build a behavioural profile.
Social network embeds and the cookies they normally bring with them.
Fingerprinting used as a substitute for cookies.

04Local storage, which is not a cookie

Some small preferences are kept in your browser’s local storage rather than in a cookie. The difference matters: local storage never leaves your device and is never transmitted to our server with a request.

Today this holds two flags: one recording that you have already seen a tool’s introductory walkthrough, and one recording that you closed the short cookie notice, so neither is shown again every visit. Clearing your site data removes them, and the only consequence is that each appears once more.

The browser also keeps an offline copy of the site’s own scripts, icons and pages you have visited, so the site loads quickly and can be installed as an app. It holds none of your documents and none of your account data, and it is never sent to us.

05Removing or blocking them

You can clear these cookies from your browser’s site-data settings at any time, and you can block them entirely. Because they are strictly necessary, blocking has real consequences rather than none:

Blocking pm_anon means each request looks like a new browser. The limit then falls back to the hashed-IP signal alone, which is shared with anyone else behind the same connection, so you are likely to hit the hourly limit sooner rather than later.
Blocking pm_session means you cannot stay signed in — you will be returned to the login page on every navigation. Guest use still works normally.

Clearing pm_anon does not reset your usage allowance, which is also anchored to the hashed IP signal. That is intentional, and it is described in the Privacy Policy.

06If this changes

If KovaPDF ever adds a cookie that is not strictly necessary, it will not be set until you have been asked and have agreed — and this page will list it before it appears anywhere. The date at the top of the page tracks any revision. Questions: support@kovapdf.com.