Home

Your files never leave your device

What happens to a file you open

Every tool runs inside your browser: pdf-lib and Ghostscript (compiled to WebAssembly) in Web Workers, pdf.js for rendering, tesseract.js for OCR, and either your browser's built-in AI or Transformers.js models for everything that reads or writes words — summaries, translations, the copilot, and the Write-with-AI button on document fields. There is no server that receives your file, no account, and no analytics.

Nothing you type into a prompt, and no part of a document you ask about, is sent anywhere. The model runs in this tab, on this machine. Artwork drawn from a description is drawn with a canvas here — there is no image model and no image service.

This is enforced, not promised: the page ships a Content-Security-Policy whose connect-src allows only this origin plus the model hosts below. Open your browser's Network tab while using any tool and you will see no request that carries your document.

The two exceptions

  1. Model weights for the AI features. If your browser has no built-in on-device AI, open models are downloaded once from huggingface.co (100–600 MB) and cached. That download contains no data about you or your document; the text is processed locally afterwards. Downloads lists every one with its size, fetches them when it suits you, and removes them again.
  2. Your browser's own model. Chrome and Edge may download their built-in AI model (Gemini Nano) the first time it is used. That is your browser talking to its vendor, governed by its privacy policy — again with none of your document's content.

Where saved files live

Files you keep in the Library are stored by your browser, on this device, in its private storage for this site (a SQLite database via granthdb plus the file bytes). The browser can evict this storage, and so can you: Clear local data in the Library removes everything. Set a passphrase to encrypt names, previews and contents at rest with a key derived from it and held only in memory. A forgotten passphrase is unrecoverable by design.

Licences

Compression and repair fall back to GhostPDL/Ghostscript when the faster paths cannot do the job, licensed under the GNU AGPL-3.0 and delivered to your browser as WebAssembly from okathira/ghostpdl-wasm (source: ArtifexSoftware/ghostpdl). Other components: pdf-lib (MIT), pdf.js (Apache-2.0), tesseract.js (Apache-2.0), Transformers.js and ONNX Runtime (Apache-2.0), sqlite-wasm (Public Domain), granthdb (MIT).