How your files are handled
Editing your document happens here, in this browser. A few jobs are genuinely better on a bigger machine, and for those we pick whichever will give you the better result — then tell you which we picked. If you would rather nothing ever left this device, one setting does that.
Work on this device only
Turn this on and nothing is ever sent — not a font, not a page, not a word. The two route-picking tools get slower, and each says which setting did it.
Check it yourself
Three things you can do in the next two minutes. None of them requires trusting us.
Watch the network while you type
Open your browser’s developer tools, go to the Network tab, and edit a document. Editing is local, so nothing new should appear — and if you then use one of the tools that needs our machine, you will see exactly one request.
Turn the network off and keep working
Switch off wi-fi, or tick Offline in the Network tab. Open a PDF and edit it. If it needed us, it would stop.
Read what it is built on
The parts we did not write are listed with their licences. What we did write is not public, and pretending otherwise would be the dishonest bit.
See noticesEvery tool, and where it runs
Eight always run here, and two run wherever will do it better.
- Editing the text Always here
Reading, changing and rewriting the file all happen here. This is the flagship and it is never sent anywhere.
- Find and replace Always here
The search runs over text already in the file.
- Signing and filling in forms Always here
Your signature is stored in this browser and nowhere else.
- Pages: reorder, split, combine, rotate Always here
Rearranging pages never needs to leave the machine.
- Making it smaller Always here
Shrinking the pictures happens on your own processor.
- Removing text for good, and cleaning up Always here
Deleting words and stripping hidden details, all here.
- Marking up and comparing Always here
Highlights, notes and version comparison.
- Passwords Always here
Encrypting and decrypting happen in the browser. We never see the password.
- Reading a scanned page Whichever is better
We pick whichever will read it better. A clean printed scan is fine here; handwriting is much better on our machine, and a 400-page scan on an older device would take minutes here and seconds there. Whichever we suggest, you decide, and we remember it.
- Matching an unusual font Whichever is better
If a font cannot supply a letter you typed, we can look for a match. Only the font is sent — never the document.
What is stored, and where
A copy of what you were working on
Kept in this browser so a closed tab does not lose your afternoon. Cleared after seven days, or whenever you clear it. It never leaves the machine.
Your signature, if you made one
Stored here so you do not draw it twice. Deleting it is one tap in Settings.
Small preferences
Light or dark, and which font stand-ins you chose before. Nothing that identifies you.
Nothing that follows you
No analytics on the tool pages, no advertising, no third-party scripts while a document is open. If something fails we record that it failed — never what was in it.
What we are not going to claim
We will not tell you your files “never leave your device”, because for a few jobs they can and a promise with an exception in it is not a promise. We will not claim we cannot see what gets sent, because when you use those tools, we can. And we will not pretend the private option is always the better one — sometimes it is four minutes of a frozen tab and a worse answer, and you deserve to be told that rather than protected from it. What we will do is name every one, say which we picked and why, remember what you chose, and give you one switch that turns all of it off.