Your files never leave your device

What happens to a file you open

Every tool runs inside your browser: pdf-lib and Ghostscript (compiled to WebAssembly) in Web Workers, pdf.js for rendering, tesseract.js for OCR, and either your browser's built-in AI or Transformers.js models for summaries and translations. There is no server that receives your file, no account, and no analytics.

This is enforced, not promised: the page ships a Content-Security-Policy whose connect-srcallows only this origin plus the model hosts below. Open your browser's Network tab while using any tool and you will see no request that carries your document.

The two exceptions

1. Model weights for Summarize and Translate. If your browser has no built-in on-device AI, open models are downloaded once from huggingface.co (100–600 MB) and cached. That download contains no data about you or your document; the text is processed locally afterwards.
2. Your browser's own model.Chrome and Edge may download their built-in AI model (Gemini Nano) the first time it is used. That is your browser talking to its vendor, governed by its privacy policy — again with none of your document's content.

Where saved files live

Files you keep in the Library are stored by your browser, on this device, in its private storage for this site (a SQLite database via granthdb plus the file bytes). The browser can evict this storage, and so can you: Clear local data in the Library removes everything. Set a passphrase to encrypt names, previews and contents at rest with a key derived from it and held only in memory. A forgotten passphrase is unrecoverable by design.

Licences

Compression, repair and flattening use GhostPDL/Ghostscript, licensed under the GNU AGPL-3.0, delivered to your browser as WebAssembly from okathira/ghostpdl-wasm (source: ArtifexSoftware/ghostpdl). Other components: pdf-lib (MIT), pdf.js (Apache-2.0), tesseract.js (Apache-2.0), Transformers.js and ONNX Runtime (Apache-2.0), sqlite-wasm (Public Domain), granthdb (MIT).