Privacidad de los documentos
Seguridad y procesamiento de archivos
Una explicación técnica pero comprensible del procesamiento en el navegador, las solicitudes de red, la memoria y los límites de seguridad.
Current file-processing model
The installed PDF Core Tools conversion and editing plugins process selected documents with browser APIs and do not contain a remote conversion endpoint that sends the selected document contents to PDF Core Tools. The separate Report an Error form is an intentional exception: optional screenshots are uploaded temporarily so they can be attached to a support email. It does not accept PDF or document files.
1. What “processed in your browser” means
- You select files through the browser’s file picker or drag-and-drop area.
- JavaScript libraries read the selected file objects into browser memory.
- The tool renders, edits, converts, compresses, combines, or packages data on the device.
- The generated result is offered as a browser download.
The source file is not placed in a server-side conversion queue under this model.
2. Network requests that still occur
Local file processing does not mean the webpage is offline. The browser still requests HTML, CSS, JavaScript, icons, fonts, workspace fragments, and advertising or consent resources. The current system may fetch:
- tool interface fragments from PDF Core Tools through same-site AJAX;
- browser libraries from the site, jsDelivr, or cdnjs;
- verified open-font files used by PDF-to-Word from the PDF Core Tools font cache;
- advertising and consent resources after those services are enabled.
These requests can reveal normal connection information to the receiving server, but they are separate from uploading the contents of the selected document.
3. Browser memory and cleanup
Files, page previews, canvases, arrays, undo state, and generated output can occupy memory while a tool is open. Reloading or closing the page normally releases the active workspace. Browsers and operating systems may temporarily manage memory, caches, crash recovery, or downloads according to their own settings.
Downloaded files are not deleted automatically because they are under your control.
4. What the server may still retain
The current tools do not retain document-conversion copies. Separate website systems may retain ordinary access logs, security events, email messages, backups, consent records, or advertising records. Optional error-report screenshots are removed from temporary server storage after the email send attempt, but may remain as email attachments in the support mailbox. These support records are separate from locally processed document contents.
5. Practical protections
Use a trusted device
A shared, public, monitored, or infected device can expose files before the website processes them.
Keep software current
Use a supported browser and install security updates.
Review downloads
Open the output, verify page order and content, and remove temporary local copies you no longer need.
Avoid public networks for sensitive work
Although document contents are processed locally, page and library traffic still uses the network.
Preserve originals
Keep an untouched backup before editing, compressing, or converting.
Check extensions
Browser extensions can access page content depending on their permissions. Disable untrusted extensions for sensitive work.
6. Passwords, encryption, and DRM
PDF Core Tools does not bypass passwords, encryption, DRM, copy restrictions, or access controls. Protected files may fail to open. Use an authorized unlocked copy or the document owner’s approved workflow.
7. Security limitations
No browser application can guarantee absolute confidentiality. Risks can come from the user’s device, operating system, browser, extensions, downloaded-file location, cloud synchronization, screen capture, malware, network configuration, third-party libraries, or future software vulnerabilities. Local processing reduces one category of transfer risk; it does not eliminate every risk.
8. Changes to processing
If a tool later needs server or third-party file processing, the relevant page must disclose it before use. The privacy and security pages will be updated, including retention and deletion information.
9. Report a security concern
Send a clear description to pdfcoretools@gmail.com. Do not publicly disclose a vulnerability before we have a reasonable opportunity to review it, and do not access other users’ data or disrupt the service while testing.