Nothing leaves your device. Here is how you can check.
Most PDF sites upload your file to a server, do the work there and send it back. Foolscap has no server. The work happens inside your browser, and the file never goes anywhere.
There is no server
This website is a folder of files: some pages, some scripts, some fonts. Nothing at this address can run code or receive a file. When you merge two PDFs, your browser does the merging, on your device, using scripts it already downloaded. There is nothing for it to send the file to.
The policy that enforces it
Every tool page carries a Content-Security-Policy. It is a rule your browser enforces: it says where the page may load things from and where it may send things. Ours is this, exactly:
default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self'; img-src 'self' blob: data:; font-src 'self'; connect-src 'self'; worker-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'; object-src 'none'
'self' means this website’s own address. connect-src 'self' means a page may only talk to this address — and because this address is a folder of files, nothing here can run code or receive a file. The policy also forbids inline scripts and anything from another domain, so no advert, tracker or third-party script can run on a tool page.
Check it yourself
- Open a tool page, such as Merge, and wait a second for it to load.
- Turn on airplane mode, or switch off Wi-Fi and mobile data.
- Add your PDFs and run the tool. It works, because nothing needs to be sent anywhere.
On a laptop, open the browser’s developer tools (press F12) and look at the Network tab while you use a tool. Every request goes to this site, and none of them carries your document.
One honest caveat
Showing some documents on screen can need a piece of the PDF renderer that is fetched from this site the first time it is used: a font the document did not embed, or a decoder for an unusual image type. That fetch goes to this site and carries nothing of yours. After your first visit those pieces are kept on your device by this site's offline app (below), so they are not fetched again.
Make searchable reads the words in a scan with Tesseract, an open-source text reader. When you open that tool, its engine and its English model (about 7 MB) are downloaded from this site, once, and your browser keeps them. Models for other languages are downloaded from this site the first time you pick one; nothing of yours is sent. The reading happens on this device, like everything else.
Digital signature uses the certificate file you choose and its password. Both are read on this device, used for that one signature, and forgotten when you leave the page. Neither is sent anywhere or stored.
What we store
The site itself, for offline use. After your first visit, your browser keeps this site's own pages, scripts and fonts (a few megabytes), so every tool opens and works with no connection and the site can be installed as an app. Those are our files, never yours. If your phone is set to save data, this is skipped. Your browser's site settings can clear it at any time.
Summarise and translate uses the AI built into your browser, which runs on this device. Your document is not sent anywhere. Where a browser has no built-in AI, that tool does nothing rather than send your document to an online one.
Your files, in your own browser’s private storage, on this device, until you leave the page. Each tool page clears that storage when it opens. Nothing is kept across visits, and nothing is sent.
We never put a file’s name, size, page count or contents into a log, an error message, a URL or a cookie. We set no cookies, and there are no analytics.
Adverts
The site is free because the home page and the guides show adverts from Google AdSense. Those pages take no files, and they are the only ones with adverts: tool pages never load Google’s scripts, and their policy (above) would refuse them if they tried.
On the pages with adverts, Google and its partners may use cookies and similar technology. Third-party vendors, including Google, use cookies to serve ads based on a visitor’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on visits to this site and/or other sites on the internet. You can opt out of personalised advertising in Google’s Ads Settings, and read how Google uses information from sites that use its services. Visitors in the European Economic Area, the UK and Switzerland are asked for their consent first.
The pages with adverts carry a looser policy that lets Google’s scripts run. Nothing you do in a tool reaches them: each tool page is its own page with the strict policy, and your files are only ever opened there.
Links that leave this site
Get help, Buy me a coffee and Tell a friend on WhatsApp are ordinary links. Nothing is fetched or sent until you tap one, and then it opens your mail app, WhatsApp or buymeacoffee.com, carrying nothing from this page but the site’s address. If you ask us for help, please don’t attach your documents: we never need them.
Still not sure? Good. Do not take our word for it: open the Network tab and watch.