Transparency
Nothing to hide.
Your PDFs are opened, edited and saved inside your browser. No server ever receives them. This page explains how that works, lists every network connection the app can make, and shows you how to check it yourself, without having to take our word for it.
Where your document goes
- Your PDFRead from your disk into memory
- Your browserThe editor runs in this tab, on your processorEditOCRRedactEncryptCompressSign
- Saved locallyA new file, written back to your disk
Outside your device
What doesn't exist, by design:
- No document upload
- No processing server
- No document database
- No analytics pipeline
Your browser enforces this with a strict Content-Security-Policy. See every connection
Our promises
Properties of how the product is built, not marketing claims. Each one can be checked with the steps further down.
Your files never leave your device
Editing, OCR, redaction, compression and encryption all run in your browser. We have no server that could receive a document, and nothing is uploaded.
No account, no sign-up
There is no login and no account system at all. Open the page and start working.
No tracking
No analytics, cookies, fingerprinting, tracking pixels, profiling or “anonymous usage statistics”.
No paid tier, nothing locked
Every feature is available to everyone, with no file size, page or daily limits. Donating unlocks nothing, because there is nothing to unlock.
No upsell, ever
No “Upgrade to Pro”, trial timers or nag screens, and no watermark that disappears if you pay.
No personal details asked
The app never asks for your name, email or phone. Fields like “name on stamp” are optional, go only into your PDF, and are never stored. The only exception is people who choose to be thanked: bug reporters and donors can share a name and profile links for the Thanks page, and donors can share an email for an appreciation token.
No data saved
No database, no logs of what you edit, and no copies. Your browser only remembers what you explicitly allow (listed below), and you can wipe it with one click.
Ads, if ever: never annoying
We may show a small number of ads in future to cover costs. If we do: no pop-ups, no autoplay, nothing covering your work or inside your documents, no tracking-based targeting, always clearly labelled, and every feature stays free.
Honest about limits
We publish what the app can't do yet, and why. See where we fall short.
How local processing works
It works like a calculator app: it can't send your sums anywhere, because it was never built to.
Your browser downloads the editor once
The same way it downloads any web page: code, styles, fonts and the OCR engine. From then on the editor is a program running on your computer.
Opening a PDF reads it into memory
The file goes from your disk into this browser tab. Every edit, recognition and redaction is computed right here, on your processor.
Saving writes a new file to your disk
The result is built in memory and handed straight to your browser's save dialog or Downloads folder. Your original file is never changed.
After the first visit, it works offline
Your browser keeps a copy of the app's own files (never your documents), so you can disconnect entirely and keep working.
Network connections
This is the complete list of connections the app can make today. There are no others. If this ever changes (for example if ads are added), this list will be updated first.
| What | Destination | When | What is sent |
|---|---|---|---|
| The app itself HTML, code, styles, fonts, OCR engine and English OCR data | This website | When you open a page, then cached for offline use | A normal page request. No document data |
| Extra OCR language packs German, Hindi, Japanese… | cdn.jsdelivr.net A public open-source CDN | Only if you choose a non-English OCR language and confirm the download prompt | A request for the language file. The CDN sees your IP address, like any website. No document data |
| DyadForge Signer Enterprise helper app for smart cards and system certificates | 127.0.0.1 Your own computer. It never leaves it. | Only if you choose On this computer in Sign with certificate: a check for whether the helper is running, then signing if your organisation uses it | The file name (shown in the helper’s approval dialog) and a 32-byte fingerprint to sign, after you approve it. The certificate you pick comes back. No document data |
| Timestamp server DigiCert, Sectigo, SSL.com or FreeTSA | The server you choose, contacted by DyadForge Signer (not this page) | Only if you tick Add a trusted timestamp when signing | A fingerprint of the signature. The server sees your IP address, like any website. No document data |
| Bug reports | “Send anonymously”: our report relay service, which forwards it to our inbox. “Email from my account”: your own email app. | Only when you click one of those buttons | Only the report text you read and approved: no document, no file name. Sent anonymously it carries no email address or name, unless you add them to be credited. No document data |
| Donation platforms | The platform you choose | Only if you click a donation button, which opens their site in a new tab | Nothing from us. We strip the referrer, so they can't see which page you came from. No document data |
Enforced by your browser, not by our word. The site sends a strict Content-Security-Policy that tells your browser to refuse connections to anywhere except this site, the OCR language CDN and the DyadForge Signer helper on your own computer (127.0.0.1), which organisations can install. Even a bug in our code couldn't upload a file somewhere else. Read the policy this page is running under.
What the browser stores
Only what you explicitly allow, and all of it can be removed with one click.
Stored, only if you choose
- Your light/dark choice, if you switch it.
- Signatures, only if you tick “Remember in this browser” when creating one (off by default).
- An offline copy of the app's own files, so it works without internet. Never your documents.
Never stored
- Your documents, file names or page contents.
- Your name, email or any identifier. They're never asked for, and never stored.
- Usage history, clicks or “sessions”. Nothing is recorded.
- Checking…
Verify it yourself
You shouldn't have to trust a privacy claim. It takes about two minutes to check ours with tools already built into your browser.
Watch the network
Open your browser's developer tools (F12, or ⌘ ⌥ I on a Mac) and choose the Network tab. Tick Preserve log, then open, edit and save a PDF.
Every request goes to this site and asks for one of its own files, such as a font or the OCR engine. None carries your document.
Pull the plug
Load the editor, then turn off Wi-Fi or switch to airplane mode. Open, edit, sign, redact and save a PDF. Everything still works, because nothing needs our server.
Read the policy
In the Network tab, click the page request and find the
Content-Security-Policyresponse header, or look for the meta tag in the page source. The same policy is shown live alongside these steps.Look for trackers
Use any tracker blocker, such as uBlock Origin, Privacy Badger or Ghostery. It will find nothing to block.
Check what's stored
In developer tools, open Application (Chrome, Edge) or Storage (Firefox, Safari). You'll see only the items listed above, and no cookies.
Read the code
The complete source code is public, so anyone can audit it.
Reading…
- Checking…
From your browser's own record of this page's requests (Resource Timing). Nothing is sent anywhere to produce it.
Known limitations
What we can't promise, stated plainly. For product limitations such as fonts, signatures and file conversion, see where we fall short.
Your own device
Browser extensions, malware or a managed work computer can see anything on your screen. We can't protect against those.
Standard web-server logs
Like every website, the server delivering the app may record basic request data (IP address, time, which file was requested) for security and abuse prevention. We add no analytics on top, and these logs never contain your documents, because documents are never sent.
What you put in your PDF
Text, stamps, signatures and document properties you add become part of the file you share. Use “Remove metadata” when saving if that matters.
Other services
The OCR language CDN (jsDelivr), the service that relays anonymous bug reports, the timestamp server you choose when signing, and any other website you open from a link here each have their own privacy policies. Like any website, they can see your IP address when you connect to them.
Funding model
Today the project is funded by voluntary donations, which unlock nothing. There are no investors to repay, no data deals and no “enterprise edition” holding features back.
In future we may also show a small number of ads. If we do, they will follow the “never annoying” rules above and will be announced on this page before they appear. The ad provider will be added to the network connections table first, so you always know what connects where.
Change history
If anything on this page changes, the change and its date are recorded here before it takes effect.
| Date | Change |
|---|---|
| 27 Sep 2026 | Added support for DyadForge Signer, the enterprise helper for certificate signatures. If you choose On this computer when signing, the page may connect to 127.0.0.1 (your own computer, never the internet). If you ask for a timestamp, the helper sends a fingerprint of the signature to the timestamp server you choose. No document data is sent, and no other connection was added. |
| 26 Sep 2026 | Page redesigned and wording clarified. No promise was added, removed or weakened. Added live views of this page's security policy and contacted origins. |
| 25 Sep 2026 | Page published. |
Found a problem or an inaccuracy on this page? Report it.