The most important thing to know
Editing is not redaction. Where the exporter can prove which instructions drew the text you changed, it removes them; where it cannot, it paints over them. Which of the two happens depends on the file and is not known until you export, so the exported file may still contain the old words.
Removal reaches one block and nothing else — not other copies of the same words elsewhere on the page, not the document metadata, not an attachment, and not an earlier saved revision inside the same file. This is not a redaction tool and must not be used to remove confidential information.
The same holds for images and graphics that were already in your PDF. Deleting one takes it off the page, but its data stays in the exported file: the image itself, or the drawing instructions of a graphic, can still be extracted from it.
Your documents
- Files are stored privately and are never publicly readable.
- Download links are tied to one file and expire within minutes.
- Your original file is never overwritten. Every export creates a new version.
- Files are deleted when you delete them or when your plan's retention period ends, and we record when each deletion was requested and when it left primary storage. The privacy policy sets out the periods, including backups.
Handling untrusted files
Every uploaded PDF is treated as hostile input. Parsing runs with hard limits on time, memory, object count and decompressed size, so a malicious file cannot exhaust the service. JavaScript embedded in a PDF is never executed. The editor's exports are re-parsed and structurally verified on our servers before you can download them.
The in-browser PDF tools, such as adding a watermark, never send your file to us, so those checks do not run on what they produce. Instead your browser opens the new file again and draws its first page before offering the download. That catches a file that does not open at all; it is not the full structural check the editor's exports get. These tools refuse password-protected and encrypted PDFs, and limit the size and page count of what they accept, to make it less likely that a large file exhausts your device. The limits are provisional, and a phone with little memory may manage less.
Locked and restricted PDFs
A PDF that opens without a password but carries usage restrictions is accepted and edited, which means the restrictions its author set are not enforced. If that matters for a document, check before you edit it.
A PDF that needs a password to open is accepted only if you give us the password. We use it to unlock the file and then delete it. It is never written to a log, and never stored alongside your document — it is held only until the file is unlocked, and at most fifteen minutes. What we keep is the unlocked document, because editing and exporting happen later, when there is nobody to ask. So a file you had password-protected is stored here without that protection, under the same access controls and the same retention period as any other document, and is deleted with it.
Your account
- Passwords are hashed with Argon2id and never stored or logged in readable form.
- Session tokens live in a cookie JavaScript cannot read, and only a hash is stored.
- Changing your password signs out every other session.
- You can see and revoke your active sessions.
Staff access
Our administration console shows a document's size, page count and processing status. It has no way to open a document, show its contents or show its thumbnail. It does show account email addresses and the feedback you send us, including any attachments. Signing in to it requires a second factor, and changes made through it are recorded in an audit log.
The people who run our servers can reach the database and file storage directly, as the operator of any service can. That access is not recorded by the application. We do not look at your documents unless you ask us to while we help you with a problem, or the law requires it.
Analytics and advertising
The editor and your document pages load no third-party analytics or advertising code at all. Product events go to our own server, which drops any property not on a fixed list before storing them and forwarding them to our analytics provider, so document contents and file names cannot reach a third party even by accident. No advertising runs on the site.
Accessibility limits
The public site and account pages target WCAG 2.2 AA. The editor is a canvas-based interface and does not meet that standard; it supports keyboard navigation of page objects, but we do not claim full screen-reader support.
Reporting a vulnerability
Email [email protected]. Tell us what you found and how to reproduce it. We will acknowledge within five working days. Please do not access other people's data while testing.