Don't trust us.
Verify it yourself.
The strongest privacy claim is one you can test. We invite you to inspect PDFMacro the same way you would inspect any evidence: with your own eyes, under your own control.
Open the PDFMacro workspace.
Navigate to any tool — Redact for production, Bates stamp, or OCR. The workspace loads entirely in your browser. No installer, no login, no cloud account.
Press F12 and open the Network tab.
Use Chrome, Edge, Firefox, or Safari. Filter by 'Doc' or 'XHR'. Keep the panel visible. You are now monitoring every byte that leaves this tab.
Drop in a document and run a tool.
Upload the largest, most sensitive PDF you have. Run redaction, OCR, or Bates numbering. Watch the network log. You will see zero outgoing requests carrying your document. Your files never leave your browser.
The Network panel will show static assets — JavaScript bundles, fonts, and stylesheets — loaded from the same origin or cache. You will see no POST requests containing PDF data, no multipart uploads, no calls to remote analysis APIs, and no telemetry batches carrying document content. If you see anything that looks like a file upload, screenshot it and send it to us. We will fix it immediately.
Fully client-side.
By design, not by promise.
PDFMacro is built with WebAssembly and modern browser APIs. The PDF parser, the redaction engine, the OCR model, and the export compressor all run inside your browser tab. There is no server-side component that handles your file. We did not merely turn off uploads — we removed the upload path entirely.
Your document is read into memory as an ArrayBuffer, processed by local code, and written back to disk via the browser's native download mechanism. At no point is your data serialized and sent over a network connection.
The AI is client-side too. Sensitive-data detection, privilege review and semantic search run neural models inside this tab. The models download to your machine once, and the document is fed to them locally. Nothing is sent to OpenAI, Anthropic, Google or any hosted inference API — there is no code here that could. The only network request AI makes is fetching the model weights themselves, once; after that these features work with the internet disconnected. The optional Chat with PDF tool is the one deliberate exception: if you connect your own Ollama or LM Studio server, document excerpts go to that server — your machine, your choice — and never anywhere else.
There is no /upload, /process, or /convert route on our server. The application is a static site.
We do not call Google Cloud Vision, AWS Textract, or any third-party OCR or analysis service.
Analytics events contain page views and errors. They never contain filenames, text content, or page images.
Once loaded, every tool functions without an internet connection. The Service Worker caches all assets.
Disconnect the internet and keep working.
Load PDFMacro while connected. Then disable Wi-Fi or unplug your ethernet cable. Open a document, redact it, Bates-stamp it, and export the result. Everything functions exactly as before because nothing in the workflow depends on a server round-trip. This is not a fallback mode — it is the default architecture.
Nothing is uploaded. Ever.
No server — ours or anyone else's — ever receives your documents. There is no cloud storage bucket, no processing queue, and no temporary cache on a remote machine. Your files remain in your browser's memory and are discarded when you close the tab. We do not have access to your documents, which means we cannot lose them, leak them, or be compelled to disclose them.