Guide
PDF privacy: what happens to your files on online tools
Every time you drag a PDF onto an “online tool,” you are making a trust decision: that company can read everything in the file for as long as their systems keep a copy. Most people never read the retention clause.
This guide explains the usual upload pipeline, what “we delete after X hours” still implies, and how browser-local tools remove the need to hand over the bytes at all.
Step by step
- 1Classify the document: public flyer vs anything with identity, finance, health, or unpublished work.
- 2For sensitive files, prefer tools that process in the browser and never upload.
- 3Run Privacy scanner, then redact what should not travel.
- 4Strip metadata and encrypt before email — or use Confidential Send for that pipeline.
- 5Verify the download (selection and search through redactions areas) before you hit send.
The upload pipeline in plain language
Your browser sends the file to a server. The server writes it to disk or object storage, a worker opens it with a PDF library, and a result file is generated for download. Along the way: access logs, temporary copies, CDN caches, backups, and employee access policies you cannot audit from the outside.
Even a short retention window means the plaintext existed on infrastructure you do not control. Breaches and misconfigured buckets do not ask whether you “only needed a merge.”
What local processing changes
When the PDF library runs in your tab, the bytes never become someone else’s customer data. The site may still count page views; that is not the same as receiving your tax return.
mypdf.space is built on that model: merge, compress, OCR, redact, and convert without a PDF upload API. You can prove it with the network panel or by working offline after assets load.
A sharing checklist that actually helps
1) Minimum necessary pages. 2) Redact identifiers. 3) Remove metadata. 4) Encrypt with a password sent on another channel. 5) Prefer a private link or in-person handoff when email is the wrong medium entirely.
Privacy is a process, not a single button — but removing upload from the process eliminates an entire failure class.
Tools used here
- Privacy scannerScan a PDF for PII patterns and report what was found, without removing it.
- Auto-redact PIIDetect SSNs, emails, phones, and cards — then permanently black them out on matched pages.
- RedactDraw black boxes over sensitive regions. Matched pages are rasterized so covered text is destroyed.
- Confidential SendPrivate prep in one pass — scan/redact PII, strip metadata, watermark, encrypt — or Email Ready. Batch many PDFs into a zip.
- Encrypt PDFPassword-protect a PDF so it cannot be opened without the password.
- Remove metadataClear common Info fields (title, author, subject, keywords, dates). Does not scrub every hidden stream.
Frequently asked questions
If a site says files are deleted after one hour, am I safe?
Safer than indefinite retention, but the file still existed on their systems. For confidential documents, prefer never uploading.How do I check whether a tool uploads?
Open DevTools → Network, process a test PDF, and look for multipart uploads or large POSTs. Local tools will not send the file body.What is the fastest private workflow on mypdf.space?
Confidential Send chains scan/redact, metadata removal, watermark, and encrypt in one local pass — then review every page.
Other guides
- PDF too large to emailGet a file under the 25 MB Gmail limit — or any limit — without uploading it anywhere.
- Scanned PDF to WordWhy a scan converts to an empty .docx, and the OCR step that fixes it.
- Remove a PDF passwordStrip the password from a document you have the right to open, without uploading it.