Privacy & security
Your files are automatically deleted after processing unless you choose to save them. Most of the time there is nothing to delete, because the file never leaves your device in the first place.
Local by default
PDF editing, merging, splitting, compression, image work, OCR, Word and spreadsheet conversion all run inside your browser using WebAssembly and the Canvas API. The file is read from disk into memory on your machine and never sent anywhere. You can verify this: open your browser's network panel and run a conversion — no upload request appears.
What genuinely needs a server
Three things: decoding formats browsers cannot read (HEIC, most TIFF variants), converting legacy Office files when the optional LibreOffice engine is configured, and fetching remote media in the downloader. Each of those tools says so on its page. The file is processed in a private temporary directory and deleted before the response is finished.
Automatic deletion
Anything stored on our side — a share link, a fetched video — carries an expiry stamp of 60 minutes by default and is swept on a schedule. Expired files are removed from disk, not just hidden. Share links can also be revoked instantly, and can carry a password and a download limit.
Access control
Stored files are never listed and never guessable. Each download URL is an HMAC over the file id and an expiry time, so a link cannot be forged, altered or replayed once it has expired. Downloads are served with a strict content-security policy so a stored file can never script against this site.
Uploads we refuse
Every upload is checked by its content signature rather than its name, so a file called invoice.pdf that is really an executable is rejected. Executables, installers and script files are never processed. Requests are rate limited per client, file sizes are capped, and URLs supplied to the downloader must resolve to a public address on an allowlisted host — which is what prevents this service being used to probe private networks.
What we measure
Which tools are opened, run, completed or failed, and how long that took. That is all: no file names, no file contents, no IP addresses, no third-party trackers, no advertising identifiers. Anonymous rate limiting uses a salted hash of connection details that cannot be reversed into an address.
This deployment
Read live from this server's configuration, so it always reflects reality rather than a claim in a document.
Questions about a specific tool? Each tool page states exactly where its work happens. Browse the tools