The short version: your files never leave your device.
All conversion, editing and viewing happens locally in your browser using WebAssembly and JavaScript. Files you open are read into your browser's memory only — they are never transmitted to our servers or any third party, never stored, and never used for anything beyond the operation you asked for. You can verify this: open your browser's developer tools and watch the network tab while converting, or load the page and disconnect from the internet entirely — the tools keep working.
This applies to everything, including the tools where it matters most: the PDF editor, redaction, OCR and form filling. Because there is no upload, there is also no queue, no expiring download link and no file to delete afterwards.
There are no accounts, no signups and no forms. We do not collect names, email addresses or payment information — the tools are free and anonymous, and there is no login anywhere on the site.
One thing: a ft-theme entry in your browser's local storage remembering whether you chose the light or dark theme. It holds the single word light or dark, it is never sent anywhere, and clearing your browser data removes it. Beyond that, this site sets no cookies at all — not ours, and none from analytics either (see below). Files you open are held in memory while you work and are gone when the tab closes.
We use Google Analytics to count page views and see which tools are used, so we know what to improve. It is configured with Google's Consent Mode and every storage permission denied, and we never ask you to grant them. In that mode it cannot write cookies or store an identifier on your device: it sends cookieless pings that count a page view without building a profile or recognising you on a later visit. That is also why you are not greeted by a consent banner — there is nothing to consent to.
What Google still receives is what any web request carries: an IP address, from which it derives an approximate location, plus the page URL, device and browser type and the page you came from. Google is a third party and processes that on its own infrastructure, including outside your own country. It does not receive your files, their names or their contents — those exist only inside your browser and are never part of any request.
If you would rather not be counted at all, any content blocker or browser tracking protection stops it, as does Google's own opt-out browser add-on. Every tool works normally without analytics — nothing here is gated behind it.
Analytics aside, using this site fetches nothing from anyone else. Fonts, the WebAssembly modules, the workers that do the processing and the OCR language models are all served from this domain rather than from a CDN. That is deliberate: an external font, script or model request tells another company what you are doing, even when it never touches your file.
The OCR models are worth calling out, because the usual arrangement is to pull them from a public CDN the first time someone runs recognition — which is exactly the moment a person is working on a document they care about. They are hosted here instead, so recognising a scan generates no outbound request at all.
We do not currently display advertising. If that changes, this page will be updated before any ad network is loaded, naming the provider and what it collects — and the tool pages themselves will stay free of anything that interrupts your work.
Like any website, our hosting provider receives standard technical request data (IP address, user agent) when pages and static assets are served. This is inherent to how the web works; it never includes your files or their contents.
If our practices ever change, this page will change with them, and the date below will move. The client-side principle — files stay on your device — is the foundation of the product and will not change. Last updated 2026-08-17.
No. Every tool on this site runs inside your browser tab using WebAssembly and JavaScript. Files are read into memory, processed and written back out locally. No request carries your file, which you can confirm by watching your browser’s network panel while a tool runs.
Two ways. Open developer tools, switch to the network tab and use a tool — you will see the page and its WebAssembly modules load, and no request containing your document. Or load a tool page, disconnect from the internet entirely, and keep working: everything continues to function because the processing was never remote.
There is nothing to store. Your file never reaches us, so there is no storage, no retention period and no deletion request to make. When you close the tab, the file is gone from memory.
No cookies at all. We set none of our own, and Google Analytics runs with every storage permission denied, which means it cannot write cookies or store an identifier either. The only thing kept on your device is your light or dark theme choice, saved in local storage as the word "light" or "dark".
Because there is nothing to consent to. Analytics is configured in a cookieless mode by default and we never request storage permission, so no consent is required to count a page view.
Any content blocker or your browser’s built-in tracking protection will block it, as will Google’s own opt-out add-on. Nothing on the site is gated behind analytics, so every tool works exactly the same with it blocked.
No account, no signup, no email. There is no login form anywhere on the site and no newsletter gate in front of a tool. We do not know who you are.
Local processing removes the usual exposure of an online converter — the file is never transmitted to infrastructure you do not control. That said, you remain responsible for your own device, browser and any extensions you have installed, and for whether your organisation permits browser-based processing of a given document.