The short version: your files never leave your device. PDkef has no server that receives, stores, or processes the PDFs you work with. Every tool, merge, sign, split, compress, edit pages, convert, redact, unlock, or protect, runs in your browser using JavaScript and WebAssembly, the same way a desktop app would. There is no upload step to skip; there is nothing to upload to.
- PrivateYour files are never sent anywhere else, the Drive page included.
- LocalEvery tool runs in your browser, like a desktop app.
- Open sourceRead the exact code on GitHub, this policy included.
No accounts, no cookies
PDkef does not ask you to sign up, log in, or create an account, and it does not use cookies. Nothing about your visit is tied to an identity.
What is measured, and what is not
PDkef uses same-origin Vercel Web Analytics for basic, aggregate page views, the same category of measurement a paper counter at a doorway would give you: how many visits a page got, not who made them.
Separately, PDkef sends anonymous, sanitized maintenance telemetry, things like which tool ran, whether it succeeded, and a coded error category, so bugs can be found and fixed. That allowlist explicitly excludes anything that could identify you or your document: no filenames, no text you typed, no signatures, no document or user IDs, and no raw error payloads. This telemetry exists purely to keep the tools working; it is never used to build a profile of you, and it never blocks a tool from working offline. All of it goes to PDkef's own address, like the error notes below, and we keep it only as daily totals per tool for 90 days (Sign's also by browser family and version).
When something in our own code breaks, your browser may also send PDkef's own address one small anonymous note: which part of PDkef failed, the error's name, the lines in our code that led there, a few facts about the page, like whether you installed it, and anonymous crash data to fix unreported runtime errors. It never carries the error's message or anything from your document, and we keep daily counts and the latest example of each error, by browser family and version, for 90 days.
Drafts and local storage
The Sign and Redact tools can save a draft of your work in progress so you do not lose it if a tab closes. That draft, the source PDF and your edits, is stored in your browser's own IndexedDB storage on your device, with an automatic 28-day expiry. It is never uploaded anywhere.
Opening a file from Google Drive
If you choose PDkef from the Open with menu in Google Drive, one page, /drive/, signs you in with Google and asks for access to that one file only. The file goes from Drive straight to your device, and PDkef never sees your Google password or the rest of your Drive. Your file is never sent anywhere else, and no other page on PDkef loads anything from Google. Picking a file from Drive in your device's own file picker involves no Google sign-in at all. How to open a PDF from Google Drive has both ways, step by step.
A technical backstop, not just a promise
These are not just policy statements: PDkef ships a strict Content-Security-Policy that locks connect-src down to the site's own origin (the Drive page above adds Google's, and only there), so the browser itself blocks any script from sending data to a third-party server, even if a future bug tried to add one by accident.
Because PDkef is open source, none of this has to be taken on trust: you can read the exact code that runs on your device, including this policy, for yourself. Questions about any of this are welcome on the contact page.