How the PDF Toolkit handles your documents: everything runs on your device and nothing is uploaded.
All PDF parsing and writing runs in the browser through Web Workers. No document bytes are transmitted.
The toolkit is a set of static files and a Web Worker. When you choose a file, the browser reads it into memory on your device and the worker edits it there. No request carrying document bytes is ever made, because there is no server endpoint to make one to.
You do not have to take that on trust. Open your browser’s developer tools, switch to the network panel, and run any operation: you will see no upload. An automated test in this repository asserts the same thing on every build.
Nothing about your documents is stored. File names, page contents and sizes exist only in the tab’s memory while you are working, and are gone when you clear the files, navigate away, or close the tab.
The only value this site may keep is a consent preference, saved in your browser’s local storage if you ever change it. It contains no personal data and never leaves your device.
Both are disabled. There is no advertising script, no analytics script, no tag manager and no tracking pixel anywhere in this product, and no advertising or analytics identifier exists in the source code.
The analytics module in the codebase is a no-op that is switched off in every environment. Even if it were enabled, it is restricted to five counters about whether an operation succeeded, and it is structurally unable to attach a file name, a file’s contents, or a URL.
The "Clear files and free memory" control releases the rendered page images, drops the file buffers and shuts down the background worker, so nothing from that document is still held by the tab.
This matters more than it sounds. The tool this product replaced created preview images and never released a single one, so every page you previewed stayed in memory for the lifetime of the tab — enough, on a phone, to get the tab killed.