How your files are handled
Every tool here runs on your device — reading, editing and rewriting your file never leaves this browser. Two things can put a request on the wire today: your browser’s own spell-check, on the text you edit (the setting below turns even that off), and the link import, which asks a site you name for a file — it carries no document of yours, but that site does see the request. Two more assists for a bigger machine are planned — matching a font we do not have (not built) and cleaning a signature’s background on our server (built, but switched off until its last checks are signed) — and both would ask first.
Work on this device only
Turn this on and nothing will ever be sent — not a font, not a page, not a word, not even a fetch. It does two things today: it turns off your browser’s spell-check on the text you edit, and it pins the link-or-drive import step to this device. It is also the standing answer for the planned assists below.
Check it yourself
Three things you can do in the next two minutes. None of them requires trusting us.
Watch the network while you type
Open your browser’s developer tools, go to the Network tab, and edit a document. Everything we do is local, so nothing of ours should appear — the only request you might see is your browser’s own spell-check, if you have its online mode on.
Turn the network off and keep working
Switch off wi-fi, or tick Offline in the Network tab. Open a PDF and edit it. If it needed us, it would stop.
Read what it is built on
The parts we did not write are listed with their licences. What we did write is not public, and pretending otherwise would be the dishonest bit.
See noticesEvery tool, and where it runs
Fourteen run here today. Three can reach the network — the link fetch already does (to the site you name), the signature clean-up is built but switched off, and the font match is not built yet — each only with your say.
- Editing the text Runs here
Reading, changing and rewriting the file all happen here. This is the flagship and it is never sent anywhere.
- Finding and replacing text Runs here
Search and replace run over the text already in the file — even across several open documents.
- Signing, filling in and creating forms Runs here
Your signature is stored in this browser and nowhere else; the fields you create are written here; and cleaning a photographed signature’s background runs a small model on this device — the image never leaves.
- Pages: reorder, split, combine, rotate Runs here
Reordering, splitting, combining, rotating, cropping, scaling, N-up and booklets — all of it happens on the machine.
- Marking it up Runs here
Highlights, underlines, shapes and notes, all here.
- Watermarks, page numbers and headers Runs here
The text stamped on pages is composed here, with the range and position you pick.
- Converting to text, Markdown, HTML or images Runs here
Conversion runs here: the text, structure and images come out of the file without leaving this browser, and images can become a PDF here too. Word and Excel are still not built — they are not offered as if they were.
- Reading a scanned page Runs here
The words are read here, in your browser — nothing is sent. English and Spanish today; a page that already has text is left alone, and a scan too unclear to read is told so, not guessed.
- Using the camera for a page or a signature Runs here
The browser asks for the permission and you decide; the picture is cropped and corrected on this device — it is never sent.
- Bookmarks, attachments and layers Runs here
The outline, attached files and optional-content layers are listed and edited here — attachments are stored, never opened or run, and never leave this device.
- Cleaning, repairing and protecting the file Runs here
Compressing, repairing, greying, extracting images, editing metadata and adding or removing a password — all of it runs here, on the working copy.
- Removing content for good Runs here
Marked text and areas are deleted from a fresh copy of the file, here — the original never leaves this browser, and neither does the copy. Where removal cannot be proven, it refuses rather than pretend.
- Comparing two files Runs here
The word-level and pixel-level comparison runs between the two documents open here.
- PDF/A and accessibility checks Runs here
The checks and fixes run here — the report downloads rather than sends, and the colour profile comes from the same origin as the page.
- Running one tool across every open file Runs here
Batch mode works through the open documents here, file by file — every result downloads from this browser.
- Matching an unusual font Planned
Planned, not built yet. If a font could not supply a letter you typed, it would look for a match, sending only the font — never the document — and ask you first.
- Cleaning a signature’s background on our server Built, off
Built but switched off until its last checks are signed. If it turns on, only the picture — never the document — would go to our own service, it would be deleted after processing, and the labelled step would say so before anything was sent.
- Bringing a file in from a link or a cloud drive Links on · drives off
The link is live: your browser asks the site you name for the file — that site sees the request; we see nothing, there is no proxy. The drives (Google Drive and Dropbox) are built but off until their sign-in keys exist; when they are on, your browser talks to them directly and they see which file you pick.
What is stored, and where
A copy of what you were working on
Kept in this browser so a closed tab does not lose your afternoon. Cleared after seven days, or whenever you clear it. It never leaves the machine.
Your signature, if you made one
Stored here so you do not draw it twice. Deleting it is one tap in Settings.
Small preferences
Light or dark, and which font stand-ins you chose before. Nothing that identifies you.
Nothing that follows you
No analytics on the tool pages, no advertising, no third-party scripts while a document is open. If something fails we record that it failed — never what was in it.
What we are not going to claim
We will not tell you your files “never leave your device” as an unconditional promise, because there are planned assists that would send data — with your say-so — once they exist, and there are two things already: your browser’s own spell-check, and the link import’s fetch to a site you name (it carries no document, but the site sees the request — and the switch pins that too). We leave spell-check on so typos get caught while you edit, but in its online mode (off by default in your browser) it can send what you type to your browser’s maker — the browser’s request, not ours, which our own no-egress setting cannot stop. So we say it plainly, and the “work on this device only” switch turns even that off. When the assists arrive, we will not claim we cannot see what gets sent, because we could; nor pretend the private option is always the better one, because sometimes it is four minutes of a frozen tab and a worse answer, and you deserve to be told that. What we will do is name them, say which route we picked and why, remember what you chose, and give you one switch that keeps everything on this device.