Deletion is useful, but it happens after disclosure
Automatic deletion limits how long a service retains a file. That is valuable. It does not change the fact that the document was uploaded, received, temporarily stored and processed by infrastructure outside your device.
iLovePDF states that files processed by its online platform are automatically deleted within two hours, with exceptions for some signing services. Smallpdf states that most processed files are deleted within one hour, while account storage can retain files until the user deletes them. Those are meaningful controls; they are simply not the same model as zero upload.
The privacy timeline
- Collection: did the document leave the device?
- Transfer: which networks and jurisdictions carried it?
- Processing: which systems could access the bytes?
- Retention: how long did copies persist?
- Deletion: what is removed, when, and from which backups or logs?
A deletion statement answers the final stage. A complete privacy assessment asks about all five.
Threat models are practical, not paranoid
The right model depends on the document. Uploading a restaurant menu is different from uploading an employment contract, an identification scan, a legal bundle or a document containing children’s data. Encryption in transit protects against interception; it does not make remote processing local.
What local-first changes
In a local-first PDF tool, application code comes to the file. The file does not go to the application’s server. That removes the upload, remote-processing and retention stages for document content. It also means performance depends on the user’s device rather than a remote queue.
Bindery’s optional account stores identity, subscription state and Pro recipes. PDF content remains local.
Questions to ask any document service
- Does the web tool upload the document or process it locally?
- Where are processing servers located?
- How long are input, output and signed files retained?
- Can account storage keep documents indefinitely?
- Are documents used for analytics, training or manual support?
- Is an offline desktop mode materially different from the web mode?
Sources and further reading
Read the services’ own current statements: iLovePDF Security & Data Protection, iLovePDF Privacy Policy, and Smallpdf’s security explainer. Product policies change; check the source before making a high-stakes decision.
Document content is not the only data
Even a zero-upload tool can receive ordinary website telemetry such as page views, browser type and approximate network location. That is different from receiving the PDF itself. A clear privacy explanation should separate document content, account data, payment data, analytics and support messages instead of blending everything into one vague promise.
Bindery uses cookieless Cloudflare Web Analytics to understand which public pages are useful. PDF bytes are processed locally. If a user creates an account, Supabase stores identity and subscription-related records; Stripe handles payment details. Pro recipe sync stores workflow steps and names, not the documents processed by those recipes.
Local processing still requires good habits
Local-first architecture reduces exposure to a document-processing server, but it cannot protect a compromised device, a malicious browser extension, an unsafe download folder or a recipient who forwards the finished file. Keep the operating system and browser current, review extensions, encrypt the device, and remove temporary output when the job is complete.
Privacy is a chain. Removing an unnecessary upload is a strong link, not a substitute for every other control.