If a site says files are deleted after one hour, am I safe?

Safer than indefinite retention, but the file still existed on their systems. For confidential documents, prefer never uploading.

How do I check whether a tool uploads?

Open DevTools → Network, process a test PDF, and look for multipart uploads or large POSTs. Local tools will not send the file body.

What is the fastest private workflow on mypdf.space?

Confidential Send chains scan/redact, metadata removal, watermark, and encrypt in one local pass — then review every page.

PDF privacy: what happens to your files on online tools

By SumitPublished 1 Sept 20262 min readPrivacy

Every time you drag a PDF onto an “online tool,” you are making a trust decision: that company can read everything in the file for as long as their systems keep a copy. Most people never read the retention clause.

This guide explains the usual upload pipeline, what “we delete after X hours” still implies, and how browser-local tools remove the need to hand over the bytes at all.

Step by step

1
Classify the document: public flyer vs anything with identity, finance, health, or unpublished work.
2
For sensitive files, prefer tools that process in the browser and never upload.
3
Run Privacy scanner, then redact what should not travel.
4
Strip metadata and encrypt before email — or use Confidential Send for that pipeline.
5
Verify the download (selection and search through redactions areas) before you hit send.

The upload pipeline in plain language

Your browser sends the file to a server. The server writes it to disk or object storage, a worker opens it with a PDF library, and a result file is generated for download. Along the way: access logs, temporary copies, CDN caches, backups, and employee access policies you cannot audit from the outside.

Even a short retention window means the plaintext existed on infrastructure you do not control. Breaches and misconfigured buckets do not ask whether you “only needed a merge.”

What local processing changes

When the PDF library runs in your tab, the bytes never become someone else’s customer data. The site may still count page views; that is not the same as receiving your tax return.

mypdf.space is built on that model: merge, compress, OCR, redact, and convert without a PDF upload API. You can prove it with the network panel or by working offline after assets load.

1) Minimum necessary pages. 2) Redact identifiers. 3) Remove metadata. 4) Encrypt with a password sent on another channel. 5) Prefer a private link or in-person handoff when email is the wrong medium entirely.

Privacy is a process, not a single button — but removing upload from the process eliminates an entire failure class.

Limits worth knowing

No guide replaces legal advice for regulated data (HIPAA, GDPR roles, etc.).
Local tools cannot protect a file after you voluntarily email an unlocked copy.
Pattern-based PII detection misses context-sensitive secrets — humans still review.
Analytics and hosting providers still see that someone visited a page.

Tools used in this guide

Frequently asked questions

If a site says files are deleted after one hour, am I safe?
Safer than indefinite retention, but the file still existed on their systems. For confidential documents, prefer never uploading.
How do I check whether a tool uploads?
Open DevTools → Network, process a test PDF, and look for multipart uploads or large POSTs. Local tools will not send the file body.
What is the fastest private workflow on mypdf.space?
Confidential Send chains scan/redact, metadata removal, watermark, and encrypt in one local pass — then review every page.