Your files never leave your device.

Where your file goes

A quick map of what happens to a file you open here, and the one case where a request touches our server.

What we do (and don't) collect

"We" on this page means one person: discreetpdf.com is an independent, single-developer service. The pages themselves are static HTML, JS, and CSS, served from Cloudflare. In front of them runs one small Cloudflare Worker: it hands out those files, keeps a daily count of page views, and handles sign-in, licensing, and the contact form. It has a key-value store behind it for those things: accounts, sessions, licenses, short-lived anti-abuse counters, and counts. What it does not have is any endpoint that accepts a file. There is no analytics script on the page either (the CSP would block one anyway). The hosting provider logs basic request metadata like IP address, user agent, and response status, for the usual reasons: abuse mitigation and traffic shaping. That metadata never includes PDF content, because PDF content never reaches the host in the first place.

We do like to know, roughly, how many people use the site and how they found it. When a page is served, the site records a single row holding four things: which page, a label for where the visit came from (google, reddit, direct; never the linking URL), the two-letter country, and the number one. That is the whole row. No IP address, no user-agent, no cookie, no visitor ID. And because there is no visitor ID, no two rows can ever be linked to the same person. We read them back as daily totals, and we also read aggregate daily totals from the same Cloudflare request logs described above. There is still no analytics script, no cookie, and no beacon on the page. Open your developer tools and you'll see the page make no such request; the same Content-Security-Policy that blocks an analytics script blocks one here too. We build no profiles and don't track you across other sites. Since we set no tracking cookies and build no cross-site profile, there's no consent banner to click; what's kept on your device is your own working data (recent files, unsaved work, saved signatures and recipes) plus small preferences like theme and language, all of it clearable anytime.

If you sign in, we store an account record: your email, the ID and display name your sign-in provider gives us, when the account was created, when each provider was last used, and any license IDs. If you add a passkey, that record gains one entry per passkey: its public key and credential ID, a code for which kind of authenticator created it, how it connects (built in, USB, and so on), which optional features it supports, a signature counter, whether your device reports it as backed up, and when it was added and last used. The private key never leaves your device, and neither does your PIN, fingerprint, or face. A public key can only check a signature, never create one, and this one is useless on any site but ours. Buying a pass adds a billing record: the Paddle customer and subscription IDs, which pass it was, and when it runs out. Each sign-in also keeps a session row: when it started, when it was last used, and a copy of your browser's user-agent string (capped at 200 characters), which is what lets you tell your sessions apart on the account page, where you can sign out of all of them at once. That is the whole list. Nothing in it records which tools you open, no device fingerprints, and no profile built from your behavior. The page counts described above are separate: they are never linked to your account, because no identifier exists that could join them.

Stored on your device

The editor keeps a private, on-device copy of your recent files and any unsaved work in your browser's local storage (IndexedDB). It's what powers the Recent files list and crash recovery, so a closed tab or a browser crash doesn't cost you your work. That copy lives only in this browser on this device. It is never uploaded, and the same Content-Security-Policy above still blocks anything from sending it anywhere.

Clear recent files anytime from the editor’s start screen, or clear this site’s data in your browser to wipe everything at once. Only a handful of the most recent documents are kept, older ones are dropped automatically, and private/incognito windows keep nothing after you close them.

For the technical reader

Proof rather than promises: how the block is enforced, how to check it yourself, and independent scanners. Each section expands.

Content-Security-Policy: default-src 'none'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self' data:; manifest-src 'self'; connect-src 'self'; worker-src 'self' blob:; frame-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'

curl -sI https://discreetpdf.com/ | grep -i policy

Read next

• My privacy pledge: the version-stamped promise about your files and any future paid features.
• How I make money: no ads, no data sale, and how the site is actually funded.