My privacy pledge

What always stays on your device

The free tools (editing, merging, splitting, signing, page organizing, and the in-browser conversions) process your file entirely in your browser. The bytes are read into memory, changed on your own machine, and written back as a download. They are never uploaded, never copied to a server, and never logged. A strict Content-Security-Policy stops this page from sending data to any other site, and my server has no endpoint that accepts a file. You can verify it yourself in 30 seconds.

A few things do touch your disk, and they stay there. What the editor keeps of your work, in this browser's own storage on this device, is four things. Two are written for you: the details of your recent files (name, size, page count, and a first-page thumbnail), and a copy of the documents themselves, so that Recent files works and an interrupted session can be recovered. That pair is capped at 8 files or 150 MB, whichever comes first, oldest dropped as new ones arrive; it is on unless you turn it off, which you can do from the editor's start screen, and turning it off clears what is already there. The other two are written only when you ask for them: a signature you keep with "Save for reuse", and any PDF Recipe you save, which is a few KB of settings and never any document data. That switch does not cover those two; you delete a saved signature or a saved recipe from the list you made it in, or clear this site's data in your browser to remove everything at once. Beside them sit small preferences like theme and language. None of it is ever uploaded; the same policy that blocks everything else blocks it too. If you share a computer, the recent-files setting is the one to know about.

What would ever touch a server

A few advanced features I plan to add need a server to do their work, because the server has to read your file to process it: cloud AI (chat with or summarize a document), high-accuracy OCR for handwriting and noisy scans, and server-rendered Office conversion for the tricky layouts the free in-browser converter can’t fully reproduce. Two more move your file without reading it: encrypted share links and template sync, where your browser encrypts everything before it leaves and the key stays with you, so I hold ciphertext I cannot open. When I ship them, they will be:

• Optional and paid. Never required to use the free tools.
• Opt-in, with a clear prompt before anything leaves your device.
• On a separate address, not this one, so the free tools stay a clean, no-upload surface you can keep verifying.
• Honest about their limits. A server that reads your file to summarize or OCR it is not "zero-knowledge," and I won't pretend otherwise. I'll encrypt those transfers, process in memory, delete promptly, and never log your file's contents.

What I'll never do

• Weaken or cripple the free local tools to push you toward a paid one.
• Quietly move a feature that runs locally today onto a server. Any change to that boundary gets announced in advance, never made as a silent edit.
• Add third-party analytics, ad networks, or trackers to the site.
• Sell your data. Beyond basic server logs and anonymous page counts, the data I hold is: an account record and a session row per sign-in for anyone who signs in, a billing record for anyone who buys a pass (with or without signing in), and any message you send me through the contact form, which lives in my inbox. All detailed on the privacy page.

How I pay for it

No ads, and I never sell your data. Nothing is for sale yet; the plan is to fund the free local tools with subscriptions to the optional paid features above. Here's the full business model.