Don't trust us. Verify it yourself.
Open DevTools, switch to the Network tab, process a file. Your document never leaves your browser. See for yourself.
Verify in five steps.
Works in Chrome, Edge, Firefox and Safari. No install required: DevTools ships in every modern browser.
-
Open the app
Click /#/app in a new tab. Keep this tab open as a guide.
-
Open DevTools
Press F12 on Windows or Cmd + Option + I on Mac. Or right-click anywhere on the page and choose Inspect.
-
Switch to the Network tab. Disable cache. Clear.
Tick the "Disable cache" checkbox so the browser doesn't quietly reuse anything. Click the trash icon to clear existing entries.
-
Use any PDF tool
Pick any of them: merge, split, compress, redact, OCR. Drop a file in and click the action button.
-
Watch the Network tab during processing
Filter by "Fetch/XHR". Your file never appears in any request. You'll see a couple of tiny first-party calls. Click either one and inspect the payload to confirm there's no file, no name, no contents: a small
/api/eventsanalytics beacon (the event type, which tool, a coarse device-size bucket, and an anonymous per-tab id), and, only when you run a bulk batch, aPOST /api/usage/trackcarrying just the tool name (e.g."bulk-ocr") to count it against the free daily cap. Everything else is the initial page load and library fetches from before you started.
Or watch from here, no DevTools required.
Live counters below come from the same browser API your DevTools reads. Drop a PDF, click Run, and see whether the "KeptPDF" number moves. (It won't.)
What a sketchy version would look like.
This is the architecture nearly every PDF SaaS uses. Avoid any tool that does this with sensitive documents.
// What most PDF SaaS does — DO NOT use any tool that does this // with privileged, PHI, or tax client material: fetch('/api/process', { method: 'POST', body: yourPdfFile, // your file leaves your browser here }); // KeptPDF — everything stays in memory: const pdf = await PDFDocument.load(bytes); // ...transform locally... const result = await pdf.save(); // no fetch, no upload — saved blob is offered as a download
Read every line of source.
Our application source (the files linked below) is readable as shipped. Open any of them, or view-source on any page. Third-party libraries we bundle (pdf.js, Tesseract, pdf-lib) ship as minified vendor builds.
What we DO send.
Radical transparency means writing down everything, including the small stuff.
A bulk usage counter. When you run a bulk batch, your browser sends the tool's name (e.g. "bulk-ocr") to /api/usage/track so we can enforce the free daily cap on bulk processing. The everyday single-file tools are unlimited and send nothing here. It never sends the file, its name, size, or contents. Signed in, it's tied to your account; signed out, to a one-way hash of your IP that rotates every day.
First-party analytics. A small beacon to /api/events records how the app is used: the event type (page view, tool opened, tool run), the tool's name, a coarse device-size bucket, and an anonymous per-tab id that's erased when you close the tab. For errors, a sanitized error message so we can fix crashes. It's stored in our own database, shared with no third-party analytics company, and never includes your file, its name, or contents. Turn on "Do Not Track" and we switch it off.
Account & billing. If you sign in, your email address and a session cookie. If you upgrade, Stripe handles the payment, so we never see your card. On load, the app asks our server once whether you're signed in (/api/me).
Optional Google Drive import (Pro). If you connect Google Drive, your browser fetches the PDF from Google's API directly. It still never passes through KeptPDF's servers, but Google's terms and privacy policy apply to that transfer.
That's it. No third-party analytics SDK, no advertising or tracking pixels, no cross-site trackers, no file names, no hashes of your file, no document properties, no IP-to-document correlation. Everything above is first-party and stays in our own systems, and your file is never part of any of it.