Your files never leave your device.

Where your file goes

A quick map of what happens to a file you open here, and the one case where a request touches our server.

What we do (and don't) collect

The pages themselves are static HTML, JS, and CSS, served from Cloudflare. In front of them runs one small Cloudflare Worker: it hands out those files, keeps a daily count of page views, and handles sign-in, licensing, and the contact form. It has a key-value store behind it for exactly those things — accounts, licenses, and counts. What it does not have is any endpoint that accepts a file. There is no analytics script on the page either (the CSP would block one anyway). The hosting provider logs basic request metadata like IP address, user agent, and response status, for the usual reasons: abuse mitigation and traffic shaping. That metadata never includes PDF content, because PDF content never reaches the host in the first place.

We do like to know, roughly, how many people use the site. We get that from the same Cloudflare request logs described above, read back as aggregate daily totals on our own infrastructure. There is still no analytics script, no cookie, and no beacon on the page. Open your developer tools and you'll see the page make no such request; the same Content-Security-Policy that blocks an analytics script blocks one here too. We keep only per-day counts (never a raw IP, never a per-visitor record), build no profiles, and don't track you across other sites. And because we set no tracking cookies and build no cross-site profile, there’s no consent banner to click; the only thing kept on your device is your own recent files, which you can clear anytime.

If you sign in, we store an account record: your email, the ID your sign-in provider gives us, and any license IDs. Buying a pass adds a billing record — the Stripe customer and subscription IDs, which pass it was, and when it runs out. Each sign-in also keeps a session row: when it started, when it was last used, and a copy of your browser's user-agent string (capped at 200 characters), which is what lets you tell your sessions apart and revoke them from the account page. That is the whole list. No record of which tools you open, no device fingerprints, no profile built from your behavior.

Stored on your device

The editor keeps a private, on-device copy of your recent files and any unsaved work in your browser's local storage (IndexedDB). It's what powers the Recent files list and crash recovery, so a closed tab or a browser crash doesn't cost you your work. That copy lives only in this browser on this device. It is never uploaded, and the same Content-Security-Policy above still blocks anything from sending it anywhere.

You stay in control: clear recent files anytime from the editor’s start screen, or clear this site’s data in your browser to wipe everything at once. Only a handful of the most recent documents are kept, older ones are dropped automatically, and private/incognito windows keep nothing after you close them.

For the technical reader

Proof rather than promises: how the block is enforced, how to check it yourself, and independent scanners. Each section expands.

Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; frame-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'

curl -sI https://discreetpdf.com/ | grep -i policy

Read next

• Our privacy pledge: the version-stamped promise about your files and any future paid features.
• How we make money: no ads, no data sale, and how the site is actually funded.