Is Document Tracking Spyware?

If you would rather inspect a reading record than read a description of one, the live demo shows the dashboard on sample data with no signup, or you can create a free tracked link and send it to yourself to see exactly what the sender ends up holding.

What spyware actually is

The word has a settled technical meaning and it is narrower than everyday use. Across the three definitions cited at the foot of this page — a standards glossary and two US government agencies — the same elements recur: spyware is software, it is installed onto a system, in the agencies' wording the reader's own computer or phone, and it is put there without the user's knowledge — usually bundled with something else, or delivered by a malicious download. From that position it can reach whatever the device holds: keystrokes, browsing history, files, the camera, other applications' data.

Those elements are about location and concealment. What makes spyware spyware is not that somebody learns something about you; it is that a program is running on your hardware, under your account, outside your control. Analytics on a web page you chose to open meets none of that — no installation, nothing outside that page legible to it — which is also why a website's own analytics are not called spyware even though they count you. And what PDF tracking is sets out the mechanism from the beginning if you have not met it before.

The confusion is a fair one, though. Two different products are sold under the words “document tracking”: a hosted link that measures reading, and DRM, which really does ask the reader to install a viewer to enforce controls after download. DRM is not spyware either, but it is one category where software lands on a reader's machine — and if that is the distinction you came for, DRM versus document tracking separates the two properly.

Where the code runs — four categories, one question

One question separates the whole field: whose machine is the code on? Every row below is sorted by that answer and nothing else, because that is the axis the definition turns on.

The verdict on that table is ours to write and it is narrower than the question suggests: for measuring whether a document you sent was read, a tracked link is the pick, because it is the only row that answers the question without anything landing on the reader's device. Where PDFTrackr wins inside that row is the thing after the comma — the automated opens are separated out rather than counted, and the dashboard shows what the filter removed instead of quietly shrinking the number. Where a pixel wins is reach: it works in a plain email with no link for anyone to click, and no hosted document does that.

What the record holds, named field by named field

A category argument is easy to make and easy to doubt, so here is the specific product, read out of the files that write the row rather than out of a feature list.

No IP address is stored. In backend/src/services/visitIdentity.ts, the insert that creates a reading session writes ipAddressHash: null after the rest of the values are spread in, so a caller that passes one has it dropped rather than persisted. The comment beside it calls that the structural guarantee, which is the right description: it fails closed rather than relying on nobody making a mistake later.

The visitor identifier rotates daily and is then destroyed. The reader is identified by a salted hash of their address and browser string — and the salt is a random value minted fresh for each UTC day, held in Redis with a forty-eight-hour expiry and discarded afterwards. Once that salt is gone the hash cannot be recomputed from anything, so the same reader on two different days is two unrelated rows by construction. There is no cookie and no browser storage involved in it at all.

Location is a country, and it is resolved offline. backend/src/services/geolocation.ts answers with a two-letter country code from a database bundled with the application. No city is populated on that path and no request leaves our servers to ask a third party about the reader. A country is what a reader worried about being located should expect a document link to know about them, and it is the ceiling rather than a starting point.

A name appears only when someone typed one. That is the figure in the box above, and it is worth restating as a rule rather than a statistic: the email gate is something the sender switches on, the reader sees the form, and the form says the address is shared with the sender. Nothing in the record identifies a reader who was not asked.

What it does hold is the reading: the pages that rendered, the order, the time on each, whether a download was clicked, and whether the same visitor came back inside the day. That is more than most senders expect, and the right response is disclosure rather than euphemism.

The part that is uncomfortable, and what to do about it

Here is the asymmetry, stated plainly: the sender decides to measure, and the reader is not told unless the sender chooses to tell them. That is true of PDFTrackr and it is true of the category. No definition rescues it, and a page that answered “is this spyware” with a confident no and stopped there would be dodging the actual worry.

What makes it defensible is that the asymmetry is the ordinary condition of the web and can be closed cheaply by whoever set it up. A sentence in the covering email — this is a tracked link, so I can see whether it arrived and which parts you read — costs nothing, and in practice it tends to help rather than hurt, because a reader who knows a document reports back treats it as a document somebody cares about. We argue that case at length in whether you should disclose document tracking, and it is the single thing most likely to change how this feels to the person on the other end.

If you are the reader, the practical position is calmer than it sounds. Opening a tracked link is opening a web page: it can see that page and nothing else on your device, and closing the tab ends the reading session. If you would rather the sender did not know, the answer is not a privacy tool — it is not opening the link.

When Pro becomes the right choice

Everything described above is on the plan that costs nothing — per-page reading, the email gate, the exclusion of automated opens, 500MB, 50 files, 50 active share links, twelve months of history, no card. Free is the product here rather than a trial, and somebody sending a handful of documents a month never needs to pay us.

Pro becomes the right choice when the volume changes what an answer is worth. Once you are sending the same document to more than a handful of named people at a time, bulk personalised links give each recipient their own link, so the record says who read it rather than leaving you to infer it from a shared URL. Once a document matters enough that a second reading is a signal worth acting on, the return-visit alert tells you the hour it happens instead of in the next morning's digest. And once you pass fifty active links the flat account removes the ceiling. Look at the demo dashboard before deciding whether any of that applies to you.

Keep reading: what PDF tracking is, whether you should disclose document tracking, and DRM versus document tracking. Or start with how free PDF tracking works.