The invisible default
The default architecture of 'online tools' is: your file travels to a server, software there does the work, a result travels back. It's invisible — a drag-and-drop feels as local as saving a file — but it's a handoff. Your document is now: transmitted over the network, stored (at least transiently) on machines you don't control, processed under a privacy policy you almost certainly didn't read, in a jurisdiction you may not share.
Most of the time, nothing goes wrong. The point isn't that these companies are malicious — it's that the design makes your caution irrelevant. You can be perfectly careful and still have your file's fate decided by someone else's retention policy.
What actually happens on upload — the lifecycle
| Stage | What typically happens | Your control |
|---|---|---|
| Transit | HTTPS-encrypted upload to the vendor's cloud | Encrypted in transit — but the endpoint is theirs |
| Processing | Software on their servers reads the full file | None — you trust their code |
| Storage | 'Deleted after 1 hour' or '2 weeks' per the privacy policy — backups and logs excepted | Trust + a deletion policy you can't audit |
| Third parties | CDNs, cloud platforms, sub-processors — each layered in the policy | Effectively none |
None of this makes upload-based tools evil. It makes them a chain of trust — and chains are only as strong as the trust you'd extend to every link, forever, for every file.
The documents that shouldn't enter that chain
Ask one question: if this file leaked, what's the damage?
- Identity documents — passport scans are the master key to identity fraud, and are a staple upload for 'compress your PDF' flows.
- Financial documents — invoices, bank statements, tax letters: enough for social engineering, fraud reports, or simple theft.
- Contracts and legal letters — commercially sensitive, personally revealing, sometimes both.
- Medical records — the category where 'sorry, a retention bug' is least acceptable.
- Anything about your children — school forms, photos, scans.
Local-first: the design that removes the question
Local-first tools flip the architecture: the software comes to the file, instead of the file going to the software. Two implementations:
- In-browser tools — the whole program is embedded in a web page. Open it, and everything runs on your machine: no upload exists to secure because there's no server to receive one. The free PDF merger here works this way — load the page, disconnect your Wi-Fi, keep working. That disconnection test is the entire difference.
- Single-file downloads — the same tool as one HTML file you own: double-click, runs offline forever, no install, no account. That's what Untracked sells — buy-once software with no subscription and nothing that phones home.
A practical checklist for sensitive documents
- Prefer tools with no upload. If a tool works with Wi-Fi off, your file physically can't leave.
- If you must upload, use the minimum viable file. Crop to the needed page; redact beyond the needed field.
- Read the deletion promise — 'deleted immediately after processing' beats 'deleted after 14 days' beats silence.
- Strip metadata before sharing photos — see the photo metadata guide for what's hiding in ordinary pictures.
- Own the tools you use weekly. A one-time purchase beats a hundred small handoffs — that's the whole Untracked model: 43 tools, buy once, own forever.