This page lays out Paplume’s data boundary in one place: what happens locally in your browser, what crosses the network, how long anything is kept — and how to verify it yourself instead of taking our word for it.
Every local PDF tool (merge, split, compress, convert, OCR, edit…) processes your file inside your browser with WebAssembly/JavaScript engines. File content is never sent to our servers or any third party — there is no upload endpoint for files at all.
Open your browser DevTools (F12) → Network tab → process a file. You will only see tiny requests: quota counting and anonymous event counters, a few dozen bytes each. There is no request carrying file content. This is checkable fact, not marketing.
AI translate/summarize/chat need a server-side model: your browser extracts the text locally and only that text (never the file itself) is sent for analysis. Sent text is discarded after processing and never written to disk; AI outputs are kept for up to 24 hours so a dropped connection can recover the result, then auto-deleted. Credit ledger entries (charges/refunds, no document content) are retained for accounting.
① Daily quota counting (anonymous device credential + IP, anti-abuse); ② anonymous usage counters (visit/submit/success/fail events — no file names, no file content); ③ extracted text on AI pages only; ④ your email and session for account features. Nothing else leaves your device.
HTTPS is enforced site-wide (HSTS), with a Content Security Policy, X-Frame-Options and nosniff headers; third-party script origins are strictly allow-listed. Inspect every header in DevTools → Network → Headers.
No ads, no selling data, no cross-site tracking, no cookie profiling. Free quotas and AI credits exist only to prevent abuse, and failures auto-refund. Full legal terms live in the privacy policy.
