Our privacy pledge

What always stays on your device

The free tools — editing, merging, splitting, signing, page organizing, and our in-browser conversions — process your file entirely in your browser. The bytes are read into memory, changed on your own machine, and written back as a download. They are never uploaded, never copied to a server, and never logged. A strict Content-Security-Policy makes an upload impossible, and you can verify it yourself in 30 seconds.

What would ever touch a server

A few advanced features we plan to add — cloud AI (chat with or summarize a document), high-accuracy OCR for handwriting and noisy scans, and instant high-fidelity Office conversion — need a server to do their work, because the server has to read your file to process it. When we ship them, they will be:

• Optional and paid — never required to use the free tools.
• Opt-in — with a clear prompt before anything leaves your device.
• On a separate address (app.discreetpdf.com), so the free tools stay a clean, no-upload surface you can keep verifying.
• Honest about their limits — a server that reads your file to summarize or OCR it is not "zero-knowledge," and we won't pretend otherwise. We'll encrypt those transfers, process in memory, delete promptly, and never log your file's contents.

What we'll never do

• Weaken or cripple the free local tools to push you toward a paid one.
• Move a feature that runs locally today onto a server quietly — any change to this boundary is announced in advance, never a silent edit.
• Add third-party analytics, ad networks, or trackers to the site.
• Sell your data. The only data we hold is basic server logs and, for people who buy a pass, an account record — detailed on the privacy page.

How we pay for it

No ads, and we never sell your data. The free local tools are funded by subscriptions to the optional paid features above. Here's the full business model.