How your files are handled

Every file tool promises that your documents are safe. Rather than repeat that, here is the actual sequence, step by step.

Your file streams from the browser straight onto disk in small pieces. It is never assembled whole in memory, which is what lets a hundred-megabyte upload work on a small server, and means there is no copy floating around waiting to be written somewhere unexpected.

We decide what a file is by looking at its opening bytes, not at its name or at what your browser claims. Renaming a program to end in .pdf does not get it any further than the front door.

Each job gets its own scratch directory, and every tool is confined to it. That directory is destroyed when the job ends - on success, on failure, and on timeout alike.

As soon as the job finishes, your original is expired and swept. It is not kept for retries and it is not kept for us to look at.

Your download link is good for half an hour, and the file is deleted once you have taken it. A cleanup process runs every minute and removes anything past its deadline, so a missed download does not become a file that lingers.

One deliberate detail: downloading marks the file as spent rather than deleting it on the spot. A browser that prefetches a link, or a download that retries, would otherwise destroy the file before it reached you.

A job row: which tool ran, when, whether it succeeded, and the name of your file so the page can show it to you. No contents. Those rows are swept too.

If you have an account, the usual: your email address, a hashed password, and your sessions. You can delete all of it from the account page, and deletion means deletion - there is no flag that hides the record while keeping it.

We cannot open them, and we do not try. A tool that meets an encrypted document says so and stops. When you use Protect PDF to add a password, the password is used and then removed from the job record before anything else happens.