pdfeditor.pageOpen a PDF

Privacy

Edit a PDF without uploading it

pdfeditor.page is a private PDF editor that runs in your browser. Here is exactly where that holds, what your device does on its own, and the few things that can leave it.

Without an account, your PDF never leaves your device.

It holds on:

Open a PDF
With the Wi-Fi off, a name is retyped in the PDF. With the Wi-Fi turned off, a lease agreement stays open in the editor and the tenant’s name is retyped in the page’s own font.

What your device does

All of this happens in your browser tab, without an account, and sends nothing of your PDF.

  • Opening your PDF and drawing its pages on screen.
  • Editing its text, pages, forms, signatures, comments and pictures.
  • Text recognition (OCR). The first time you use it, it downloads its program and language files from our server, and your browser keeps them. Your pages stay here.
  • Translation, by your browser’s own translator where it has one. Otherwise, the first time you use a language, it downloads that language’s files from our server, and your browser keeps them. Your pages stay here.
  • Recognising a formula as LaTeX. The first time, it asks before downloading its model from our server, and your browser keeps it. The picture of the formula stays here.
  • Reading aloud in the natural voice. The first time, it downloads its voice model from our server, and your browser keeps it; with Data Saver on, it asks first. The text it reads stays here.
  • Saving: the new PDF is made in this tab and downloaded to your device.

What can leave your device

The PDF file itself never does. These can, and each says what it sends.

  • A problem report you send

    It carries what you type, facts such as the app version, your browser and the page count, and a picture of the page only if you add one. Never the PDF, and your file’s name is taken out of what you wrote.

  • A request you send

    After a search, “Let us know” sends the words in its box, and which search it was, only when you press Send. They go to the pdfeditor.page team, never to Google.

  • A reference link you follow

    The Google Scholar link sends the reference’s title and first author to Google Scholar, or the start of its text when it has no title. A doi.org or arXiv link sends its identifier.

  • An online voice you allow

    Read aloud uses a voice on your device. If your browser has none, it asks first, and only if you say yes does an online voice read. Its provider then gets the sentences it reads.

  • Analytics, if you allow it

    If you allow it, Google Analytics learns which kinds of page you visit and how the app is used: tools and panels, saves and errors, with sizes and times as ranges. Never the PDF, its name, its words or what you type. If you decline, nothing is sent.

  • A crash report

    When something breaks, the app sends one on its own. Without an account it says what kind of error it was and where in the app’s code it happened, never the error’s message, so none of your file’s words.

Every host, and when

The first list is read from the security policy this site sends with every page: your browser holds the page to it and blocks any other host. The app’s background workers have a list of their own, which for now reports a host rather than blocking it. The second is where a link you open, or signing in, takes you.

What the page contacts

  • pdfeditor.page

    What it’s for
    This site, run on Cloudflare. It serves the pages, the app, and the files that OCR, translation, formula recognition and the natural voice download. It gets the problem reports and requests you send, and, with an account, your library and sign-in.
    When
    When a page loads, the first time a tool needs its files, and when you send or save something. Without an account, never your PDF.

  • sentinel.shahab.dev

    What it’s for
    Our own error-reporting service. It gets crash reports.
    When
    Only when something breaks, with an account or without.

  • www.googletagmanager.com

    What it’s for
    Google’s tag: it loads Google Analytics, and passes on what it counts.
    When
    Only after you allow analytics. Until you answer, and if you decline, never.

  • *.google-analytics.com

    What it’s for
    Google Analytics, which counts how the app is used (see Analytics). The * stands for a name such as region1.
    When
    Only after you allow analytics. Until you answer, and if you decline, never.

  • *.analytics.google.com

    What it’s for
    Google Analytics too, at its other address. The * stands for a name such as region1.
    When
    Only after you allow analytics. Until you answer, and if you decline, never.

Where you go yourself

  • scholar.google.com

    What it’s for
    A reference’s Google Scholar link. It gets the title and first author, or the start of the text.
    When
    Only when you open that link, in a new tab.

  • doi.org

    What it’s for
    A reference’s DOI link. It gets the DOI.
    When
    Only when you open that link, in a new tab.

  • arxiv.org

    What it’s for
    A reference’s arXiv link. It gets the arXiv number.
    When
    Only when you open that link, in a new tab.

  • api.workos.com

    What it’s for
    Sign-in, run by WorkOS. Your browser goes to api.workos.com, then to WorkOS’s sign-in page on its own address, and to Google or another provider only if you sign in with one, then comes back here.
    When
    Only when you sign in or create an account.

  • Your browser’s online voice

    What it’s for
    Reads aloud when your device has no voice of its own. It gets the sentences it reads. Your browser sends them, not the page, so the network panel may not list it.
    When
    Only if you say yes when Read aloud asks.

Check it yourself

You don’t have to take our word for any of this. Your browser can show you every request the page makes, and the editor works offline.

  • Watch the network panel

    On a computer, in Chrome, Edge, Firefox or Safari.

    1. Open the home page, right-click it, choose Inspect, then the Network tab, and reload the page. In Safari, first turn on Settings › Advanced › Show features for web developers.
    2. Open a PDF, edit it and download it.
    3. Each row is one request, and its domain says where it went. In Chrome, right-click the column titles to show Domain. Select a row to see what it sent. Extensions you’ve installed can add rows of their own; a private window with extensions off shows only the page’s.

    You should see

    • Requests to pdfeditor.page: the app’s own files, such as scripts, fonts and a tool’s files the first time it needs them, and the app asking whether you’re signed in.
    • Rows that start with blob: or data:. That is something held in this tab’s memory, such as your file or a page picture, not sent anywhere.
    • Google’s hosts only if you allowed analytics, and our error-reporting service only if something broke.

    You shouldn’t see

    • Your PDF, or any of its words, in what a request sent.
    • Any host not in the list above. Your browser refuses it, and the Console tab says so.

  • Go offline

    On any device, a phone included.

    1. Open the home page and let it finish loading.
    2. Switch on airplane mode. On a phone, turning the Wi-Fi off isn’t enough, because mobile data stays on.
    3. Open a PDF, change some of its text, and download it.
    4. Close the tab before you go back online, so nothing can be sent afterwards.

    You should see

    • The PDF opens, edits and downloads as it does online, and the download is on your device.
    • A tool that still has files to download, such as text recognition the first time, can’t run until you’re back online.

    You shouldn’t see

    • A message that you must be online to open, change or download your PDF.

When you sign in

An account is for keeping files, so it changes where they go.

  • Files you add to your library are stored in our cloud, with Cloudflare, so you can open them on any device.
  • Your changes save themselves unless you turn autosave off, and each file keeps earlier versions.
  • A picture of each file’s first page is kept as its thumbnail, and your notes, recordings and flashcards are kept with the file.
  • Choosing a PDF on a tool page asks first, then saves it to your library.
  • A problem report adds a picture of the page, which you can remove, and the PDF only if you tick the box.
Limits of a free account

Everything we keep, and where

Every detail, with an account and without: what is kept, where, and for how long.

  • Your PDF is opened, edited and saved by this browser tab. It is never uploaded.
  • Text recognition (OCR) runs in this tab too. It downloads its program and language files from our server, but your pages stay here.
  • Recognising a formula runs in this tab too, on your device. The first time, it asks before downloading its model from our server, and your browser keeps it. The picture of the formula stays here, and nothing is sent.
  • Reading aloud in the natural voice runs in this tab too, on your device. The first time, it downloads its voice model from our server, and your browser keeps it; with Data Saver on, it asks first. The text it reads stays here, and nothing is sent.
  • Nothing about your document is kept. When you close the tab, your work is gone, so download it first.
  • This browser remembers your settings and any signatures you save. They stay on this device. To remove them, clear this site’s data in your browser.
  • AI features are not offered without an account.
  • Work you do as a guest is never moved into an account, even if you sign up later.

  • WorkOS handles sign-in. We keep your email, your name, when you joined, and when you last signed in and used the app.
  • Files in your library are stored with Cloudflare, so you can open them on any device. Their notes, recordings, flashcards and thumbnails are stored with them.
  • Each file keeps up to 10 recent copies, plus one a day for 30 days, up to 256 MB per file. Older copies are deleted on their own, and you can delete any copy.
  • Deleting a file deletes it with all its copies and notes.
  • Changes you haven’t saved yet are kept on this device until they are, so a crash doesn’t lose them.
  • One cookie keeps you signed in. It lasts up to 30 days and is renewed while you use the app. A second one is used only while you sign in. There are no advertising cookies, and analytics cookies only if you allow them (see Analytics).
  • To delete your account, ask through Report a problem, and we will do it for you. The account is suspended at once, and the deletion is final 7 days after your request: then your files, your account and its usage records are removed.

  • For each account: its email and name, when it joined and was last active, how much it stores, and daily counts of opens, saves, uploads and AI use.
  • The daily counts are deleted after 13 months.
  • Never your files’ names, their contents or what you ask the AI.
  • There are two exceptions: a picture or a PDF you attach to a problem report, and an export of an account’s files, which we make only with a written reason. Every time we open or export one, it is written to a record that can’t be changed.

  • We ask before using Google Analytics, with an account or without. Until you answer, and if you decline, nothing is sent to Google and no analytics cookie is set.

  • If you accept, Google Analytics sets its own cookies (named _ga) and learns:

    • the kind of page you are on, such as a tool page or “a document”, never which one
    • which features, panels and tools you use, and where you opened them from
    • when a file is opened, a tool finishes, or a save or export ends, and how it ended
    • an error shown, by its kind only
    • a search that found nothing, or asked for something the app doesn’t do, as one of a fixed list of topics such as “digital signature”, never the words you typed
    • how fast the page loaded, and how long a file took to open, a search took, or text recognition took per page
    • your screen type, your theme and whether you are signed in
    • whether the visit looks like a person, after a tap, click, key press or scroll, or like an automated browser or a crawler

    Sizes, page counts and times are sent as ranges, never exact.

  • It never gets a document, its name, its words, its file id or anything you type. Signed in, it gets a scrambled number in place of your account, never your email.
  • Your answer is kept in this browser, not in a cookie, and we ask again after 13 months. To change it, use Cookie settings at the foot of any page.
  • Google keeps what it gets for 14 months, under its own policy.
  • Our server also counts page views, with no cookie and without asking: per day, how many times each kind of page was served, and how many of those went to a known crawler or an automated browser. It reads your browser’s name to tell, then keeps no IP address, no browser name, no id and nothing else that could tell one visitor from another.

  • AI features are switched off for now. When they are on, they are for accounts only. Each one sends text through our server to our AI provider, Google Gemini, and only when you use it:
  • Explain sends the text you selected and the text of its page, up to 8,000 characters.
  • Ask sends your question and up to 4 earlier questions and answers. If the document has up to 320,000 characters of text and 400 pages, it sends the whole document’s text. If it’s bigger, it sends up to 16 passages the app picks on your device.
  • Suggesting what to redact sends the text of every page, 8,000 characters at a time.
  • Making flashcards sends the text you chose, up to 12,000 characters, and your card settings.
  • We don’t store what is sent or the answers. We count how much AI each account uses per day. Google keeps its own logs under its own policy.
  • Recognise formula and the natural reading voice are not among these. Their models run on your device, with or without an account, and send nothing (see Without an account).

  • When you use Report a problem, we get what you wrote, the app version, your browser and system as your browser names them, your screen type, the part of the app and the tool you were using, the page count, and the ids of recent crash reports from this tab.
  • You can add a picture of the page. With an account you can also attach the PDF. Without one you can’t, and your file’s name is taken out of what you wrote.
  • When a search doesn’t find what you want, “Let us know” offers to send its words to us. Only when you press Send do we get them, as you left them in its box, and which search it was: the tools page, the editor or the library. Nothing else is sent with them, no account is needed or attached, and they never go to Google.
  • Signed in, after you send a request you can tick “Email me when it’s ready”. Only then do we keep your account’s id beside the request, never your address, and write to the address on your account when the request is planned, shipped or declined. These are product notices about that request only: no marketing, no newsletter. Every email has a link that stops them at once, and we delete this when the request is shipped or declined, when the request itself is deleted, or when your account is.
  • Problem reports are deleted after 30 days. A request is kept until it’s shipped or declined, then deleted 30 days later.

  • When something breaks, the app sends a crash report to our own error-reporting service. This happens with or without an account.
  • A crash report holds the kind of error and its code, where in the app’s code it failed, the part of the app (never which file), the app version, and when it happened.
  • Without an account, a crash report never holds the error’s message, so none of your file’s words can be in it.
  • With an account, it also holds the error’s message, cut to 300 characters, with quoted text longer than 12 characters and email addresses taken out. Shorter quoted text, such as a word from your file, can stay in.
  • When a save fails, its report adds only this: why, in one word (offline, a network error, a timeout, a server error, signed out, storage full, too large, a conflict, a local write error, or refused), the server’s status code, whether your browser was online, how many tries it has made, the file’s size as a range such as 1–10 MB, and the seconds since the last save. Never the document, its name or anything you typed.
  • When a download can’t start, or you tell us it never arrived, its report adds only this: why, in a word or two (blocked where the page is embedded, an app’s own browser, the download didn’t start, or the file couldn’t be made), the tool, your browser’s family such as Chrome or Safari, and the file’s size as a range such as 1–10 MB. Never the file, its name or anything in it.
  • A crash report is not tied to your account. When our server fails, it reports the error, the part of the app, and your browser and system as your browser names them.
  • When our server refuses a request, for example too many at once, it logs the reason with your account id, or your IP address if you’re not signed in. Cloudflare keeps these logs under its own policy.
  • We haven’t set how long crash reports are kept yet. This page will say when we do.

  • Cloudflare runs our servers, stores account files and keeps logs. WorkOS handles sign-in. Google counts visits with Google Analytics if you allow it, and would answer AI requests, once AI features are on.
  • For questions or requests, use Report a problem in the app.