You drop a PDF, a progress bar spins, a download link appears. Between those two moments, your document made a trip the page shows nothing of. This article reconstructs that trip — step by step, from the real privacy policies of the most-used services — then shows how to verify for yourself that a tool sends nothing anywhere.
Step 1: the file leaves for a server you did not choose
On drop, the browser sends the document in the body of a POST request, usually as multipart/form-data. TLS encryption protects the journey from interception — not the destination: once it arrives, the file is decrypted and readable by the service.
Where that server sits depends on the operator: iLovePDF is a Spanish company that states it hosts in Europe; Smallpdf, Swiss, advertises European servers; Adobe’s Acrobat online services belong to a US company running on its own cloud infrastructure. Jurisdiction matters: it sets the applicable law and the access local authorities can lawfully request.
Samsung T7 Shield — 1 TB portable SSDFast, shock-resistant SSD; sized for a complete digitized archive.affiliate
Step 2: processing — and what the terms authorize
Once on the server, the file is read by the service’s software. What it may do with it is defined by the terms you accepted — usually unread. Three examples, quoted verbatim from public pages read in October 2026:
- Adobe: the General Terms of Use provide that, “solely for the purposes of operating or improving the Services and Software”, you grant “a non-exclusive, worldwide, royalty-free sublicensable license to use, reproduce, publicly display, distribute, modify, create derivative works based on, publicly perform, and translate the Content”. The “Our Access to Your Content” section adds that automated systems may analyze content using machine learning “when the Content is sent, received, or stored”, and that uploaded files may be scanned for illegal content. After the June 2024 controversy, Adobe clarified that it does not train generative AI on customer content and offers an opt-out from the product improvement program.
- iLovePDF: the FAQ states “we won’t check, copy or analyze your files in any way” — a narrower promise, but still a contractual declaration.
- Smallpdf: the trust center limits data access to “responding to support requests or addressing technical issues”.
These texts are not confessions of bad intent: they are perimeters of authorization. The question is not whether the service will read your file, but what you have contractually allowed it to do.
Step 3: “deleted within the hour” — a promise, not an observation
This is the reassuring sentence on every privacy page. Here are the real versions:
- iLovePDF deletes files “within TWO (2) HOURS of being processed”; the terms add that content stays on the servers “as long as the download link is available”, and that the iLoveSign e-signature services follow their own durations.
- Smallpdf deletes free-tool files after one hour — but keeps e-signature documents for fourteen days, with a counter that resets on every access, and retains account-storage files until you delete them manually.
Two structural limits. First, this is a contractual obligation, not an observable fact: no user can verify from outside that a purger actually ran on schedule, on every copy. Second, the scope is narrow: the window covers the file in its intended storage — backups, replicas, processing queues and crash dumps are generally not covered by these clauses.
Step 4: logs outlive the file
Even deleted on schedule, your document left traces the deletion clause does not mechanically cover. Every server logs: IP address, file name, size, timestamp, task identifier. Those application logs are personal data — and their retention falls under the policy’s general purposes, not the “one hour” window.
iLovePDF’s policy is explicit on this point: personal data is kept “to the extent that its retention and processing are necessary to fulfil the purposes for which it was collected”, then “for as long as necessary for compliance with the relevant legal obligations”. In other words: the file leaves in two hours; its trace can stay for months or years, for security, billing or legal reasons — which is legitimate, but invisible inside the slogan “your files are deleted”.
Step 5: the download does not close the journey
The trip also involved more than your file: your IP address in access and CDN logs, a session identifier, sometimes an account. And the document itself carried embedded metadata with it — author, software, revision history — whose local cleanup is detailed in our article on PDF metadata.
The other paradigm: nothing to promise when nothing leaves
Document Flare is built on a different premise: the file never leaves the browser, so there is no deletion window to promise, no server log to purge, no subprocessor to list. That is not a policy — it is an architecture, and it is verifiable:
- The Network tab shows it: dropping a PDF into the merge tool triggers no request carrying the document. The full protocol — five minutes, replayable on any tool — is in the network test section of our article on PDF tools without upload.
- A badge measures it: on
/tools/routes, a counter continuously adds up the bytes of request bodies emitted by the app (fetch and XMLHttpRequest) and displays the total. It stays at zero because nothing leaves — its limits (sendBeacon, WebSocket and worker-internal requests are not covered) are stated in its tooltip. - The cache is bounded by a whitelist: the service worker writes only application assets and public models to persistent cache — no document byte is eligible. The single exception, the Android share-target buffer, is a dedicated cache purged on first read.
- Analytics is a no-op on tools: the analytics script (Plausible, cookieless) runs only on public pages; on
/tools/, pageview tracking transmits nothing — no file name, size or content.
Two honest caveats: AI and OCR features download a model on first use — traffic flows server-to-machine, never the reverse — and local processing does not protect against a compromised device. The full threat model is in our article on local processing privacy.
The replayable protocol: three checks in ten minutes
- Watch the network. F12, Network tab, “Preserve log”, drop a PDF whose size you know. A
POST/PUTapproaching that size is an upload; its absence signals local processing. - Read the retention clause. Search the policy for “delete”, “retention”, “hours” — then the exceptions: e-signatures, account storage, subprocessors, hosting jurisdiction.
- Run the test again before a sensitive document. An observation holds for the version observed, not the next one.
This protocol applies to us as much as to anyone else — that is exactly what makes it differentiating.
Sources
Policies and terms read in October 2026 — they may have changed since:
- iLovePDF, Privacy Policy and Terms and Conditions — two-hour deletion, iLoveSign exception, personal-data retention tied to purposes.
- iLovePDF, FAQ — “we won’t check, copy or analyze your files”.
- Smallpdf, Is Smallpdf Safe? and Trust Center — one-hour deletion, fourteen days for eSign documents, account storage until deletion.
- Adobe, General Terms of Use — content license (§4.2) and automated access (§2.3).
- Adobe, Updating Adobe’s Terms of Use (June 10, 2024) — clarification on generative AI and the opt-out.
If you spot a change in these texts, let us know through the contact page: this article is maintained as a reference.
Disclaimer
This article analyzes public documents for informational purposes; it is neither legal advice nor an accusation — it describes what the terms authorize, not necessarily what is exercised. For your own obligations (professional secrecy, GDPR), see our article on GDPR and local PDF processing and the profession-specific pieces: lawyers, health records, HR teams.
The right hardware
Samsung T7 Shield — 1 TB portable SSDFast, shock-resistant SSD; sized for a complete digitized archive.affiliate
Synology DS223j — 2-bay NASTwo-bay NAS with remote access: your personal archive off the cloud.affiliate
