Don't trust us.
Verify it yourself.
The strongest privacy claim is one you can test. We invite you to inspect PDFMacro the same way you would inspect any evidence: with your own eyes, under your own control.
Open the PDFMacro workspace.
Navigate to any tool — Redact for production, Bates stamp, or OCR. The workspace loads entirely in your browser. No installer. You can work without signing in; saving on the free plan asks you to.
Press F12 and open the Network tab.
Use Chrome, Edge, Firefox, or Safari. Filter by 'Doc' or 'XHR'. Keep the panel visible. You are now monitoring every byte that leaves this tab.
Drop in a document and run a tool.
Upload the largest, most sensitive PDF you have. Run redaction, OCR, or Bates numbering. Watch the network log. You will see zero outgoing requests carrying your document. Your files never leave your browser.
The Network panel will show static assets — JavaScript bundles, fonts, and stylesheets — loaded from the same origin or cache. You will see no POST requests containing PDF data, no multipart uploads, no calls to remote analysis APIs, and no telemetry batches carrying document content. Also expected, and none of them carry your document: a sign-in request, the free plan's daily count when you save (one number), and, if you connected one, requests to your own AI provider, which Settings → AI lists. If you see anything that looks like a file upload, screenshot it and send it to us. We will fix it immediately.
Fully client-side.
By design, not by promise.
PDFMacro is built with WebAssembly and modern browser APIs. The PDF parser, the redaction engine, the OCR model, and the export compressor all run inside your browser tab. There is no server-side component that handles your file. We did not merely turn off uploads — we removed the upload path entirely.
Your document is read into memory as an ArrayBuffer, processed by local code, and written back to disk via the browser's native download mechanism. At no point is your data serialized and sent over a network connection.
The AI helpers are client-side too. Sensitive-data detection, privilege review and semantic search run neural models inside this tab. The models download to your machine once, and the document is fed to them locally; after that these features work with the internet disconnected. Chat, summaries, writing and translation are different: PDFMacro ships no model for them, and they run on an AI you connect yourself. With your own OpenAI, Anthropic or Google key, the text a feature needs goes from this browser straight to that provider, under your account: the app asks before the first send and lists every request. With Ollama or LM Studio it goes to your own machine. PDFMacro never receives it, and with no AI connected nothing is sent at all.
There is no /upload, /process, or /convert route on our server. The application is a static site.
We do not call Google Cloud Vision, AWS Textract, or any third-party OCR or analysis service.
Analytics events contain page views and errors. They never contain filenames, text content, or page images.
Once loaded, every Pro tool functions without an internet connection; a free account needs one to save, for its daily count. The Service Worker caches all assets.
Disconnect the internet and keep working.
Load PDFMacro while connected. Then disable Wi-Fi or unplug your ethernet cable. Open a document, redact it, Bates-stamp it, and export the result. Everything functions exactly as before because nothing in the workflow depends on a server round-trip. This is not a fallback mode — it is the default architecture. (On a free account, saving needs a connection for the daily count; Pro does not.)
Nothing is uploaded. Ever.
No server of ours ever receives your documents. There is no cloud storage bucket, no processing queue, and no temporary cache on a remote machine. The only time document text leaves the tab is when you use an AI you connected yourself, and then it goes to that provider or your own computer, nowhere else. Your files remain in your browser's memory and are discarded when you close the tab. We do not have access to your documents, which means we cannot lose them, leak them, or be compelled to disclose them.