You type “iLovePDF” out of habit: merge two contracts, compress a supporting document, split a file. The service is free, fast, well built — and your file travels to a server you do not control. For a lunch menu, who cares. For a payslip, a bank statement or a medical record, the question deserves thirty seconds. An alternative exists: processing the PDF inside your browser, so it never leaves your device — with a decisive advantage, you can verify it yourself.
The test that settles it: the Network tab
A privacy policy describes an intention; the Network tab shows a fact. Open developer tools (F12 or Cmd+Alt+I), Network tab, drop a PDF and watch. A POST or PUT whose body is roughly the size of the document signals an upload. If no request carries the file and the tool keeps working offline, processing is local. The full protocol — including how we applied it to the major cloud tools — is in where do your files go.
Samsung T7 Shield — 1 TB portable SSDFast, shock-resistant SSD; sized for a complete digitized archive.affiliate
Fact-based comparison: iLovePDF, Smallpdf, local processing
| Criterion | iLovePDF | Smallpdf | Document Flare (local) |
|---|---|---|---|
| Where the file goes | Server (upload required) | Server (upload required) | Nowhere: read in the browser |
| Declared retention | Deletion within 2 h (except iLoveSign) | 1 h for free tools; 14 days for eSign | None: no document server |
| Actually free | File and task quotas | 2 tasks per day | No usage quota |
| Paid tier | Premium ≈ €7/month (listed price) | Pro ≈ €12/month (listed price) | Optional 7-day pass, €5 one-off |
| Account | Not for free tier, yes for premium | Required beyond the quota | None |
| Offline | No | No | Yes, after the first load |
| Trust basis | Policy to read | Policy to read | Network tab: observable |
Retention delays and prices come from the services’ public policies and pages — they can change. The dated, sourced clause-level analysis (signature exceptions, server logs, jurisdictions) is in our close read of the iLovePDF, Smallpdf and Adobe policies.
Where the cloud keeps its edge
Honesty first: cloud suites remain better on three fronts. Rich Office conversions — a faithful PDF → Word with styles, tables and footnotes needs heavy engines. Industrial OCR on very large volumes. And certified e-signature with eIDAS legal value, which requires a trust third party by design. If your current need is one of those three and the document is inconsequential, a serious cloud service remains a defensible choice.
What is actually local in Document Flare
The project’s capability catalog marks every operation with its processing location. Nearly all tools — merge, extract, reorder, rotate, watermark, visual signature, password protection, metadata cleanup, redaction, compression, conversion to images or Markdown — are marked LOCAL: processing runs in the browser through libraries such as pdf-lib and pdfjs, offloaded to Web Workers.
Local OCR runs Tesseract compiled to WebAssembly: it produces a .txt file and a searchable PDF (an invisible text layer over the page images). Language models download on first use — traffic flows server-to-browser, never the reverse — then stay cached. Same mechanics for the AI features: summaries and translation through the browser’s built-in models (Chrome or Edge 138+), semantic search through a ~115 MB model fetched once via Transformers.js.
Seven remote capabilities (conversions to Word, PowerPoint, Excel, HTML→PDF, server-side AI summary) exist in the catalog as REMOTE_OPTIONAL, in simulation and excluded from the public build. If they were ever enabled, each task would require explicit consent.
One more distinction matters: public pages (/, /guides/*, the legal pages) load AdSense and the Plausible cookieless analytics; the tool routes (/tools/*) are isolated — no ads, no tracker. Either way, the PDF does not leave.
The honest limits of local
Local is not an absolute guarantee. The page and its assets must load — that is normal network traffic — and OCR/AI models download on first use. The document never leaves, but this is not “zero requests”.
The technical limits are precise: most tools accept one file up to 50 MB and 1,000 pages; merging goes up to 20 files and 50 MB in total; free OCR processes the first 100 pages (the 7-day pass lifts that cap). Processing happens in RAM: a very large file can be slower than on a dedicated server, and a modern browser is required. Finally, “local” does not protect against a compromised device — malware, a nosy extension or a sysadmin on a managed machine can still read your files.
Who it is for
Local suits anyone handling sensitive or recurring documents: lawyers, HR teams, healthcare professionals, freelancers, administrations — and more broadly anyone who prefers an observable fact to a policy to read. The cloud remains useful for occasional Office conversions and inconsequential documents.
To go further: where your files actually go, what local processing really protects, and GDPR and local PDF processing.
The right hardware
Samsung T7 Shield — 1 TB portable SSDFast, shock-resistant SSD; sized for a complete digitized archive.affiliate
Transparency: this comparison is published by Document Flare, which builds local PDF processing. We have a direct interest in this approach. Verify the policies of the services mentioned — and above all, the Network tab — for yourself.
