How your files are handled

Files you choose are read into the page’s memory only. Nothing about your files is written to cookies, local storage or IndexedDB. The only thing this site itself saves in your browser is your light or dark mode choice, if you use the switch in the header.

There are no analytics or third-party scripts.

The PDF editor draws pages in your browser. Your edits stay in the page until you export; exporting uploads the original PDF and the edits so the server can produce the final file.

Results are kept in the page’s memory so you can download them again, and are released when you leave or reload the page.

Uploads and downloads travel over HTTPS. The web server in front of the app is configured to pass files straight through instead of saving request or response bodies to its own temporary files.

Every request gets its own workspace: a new folder with a random, unguessable name that only the service’s own user can open. Your file, any intermediate files, and the result are written only there. Files are never reachable by a URL.

The workspace lives on a memory-backed (tmpfs) filesystem, so documents are not written to the server’s disk. If the host has swap enabled, the operating system can page memory — including this — to swap space, like any other memory.

The converters (LibreOffice, MuPDF, pdf2docx) run as separate processes with their temporary files, settings and caches pointed into that workspace. LibreOffice is configured not to fetch external links or run macros found in documents.

The workspace is deleted as soon as the response has been sent — whether the request succeeded, failed, was cancelled because you closed the page, or timed out. Cancelling also stops any conversion still running for it.

If the service itself crashes or is restarted mid-request, that cleanup can’t run at that moment; leftover workspaces are deleted when the service starts again, and memory-backed storage is discarded whenever the container stops. A background check also removes any workspace older than about 10 minutes.

Deletion removes the files from the filesystem. It is not a forensic overwrite of memory.

The app logs each request’s method, path (for example /api/convert/word-to-pdf), status code and duration — never file names or document content. Error logs can contain converter diagnostic messages, not document text.

The web server’s access log records the request line, status, size and the visitor’s IP address, as standard. There is no database and there are no user accounts.