displaying documents stored under web root

Hi After some advice (surprise!) I currently store restricted documents beneath the web root so they are not accessible via the URL, when a valid user wishes to view a document i copy it to a temporary folder above the root and load it in a new page. the only way i can then manage to delete the copy is automatically deleting all temp files when any user goes to the log out page. This is obviously not a very good way of doing this but unless i can establish when a user is no longer viewing the doc then i dont know when to delete it. I was wandering how others deal with these problems like this any advice appreciated greatly Ade