What stays local. What reaches pdfity. What crosses a third-party boundary.
This page exists so the trust claim is inspectable. pdfity is built around a simple idea: standard PDF processing should stay in your browser by default, and any move beyond that boundary should be explicit.
What stays in-browser by default
Standard PDF processing for routine workflows such as merge, split, reorder, rotate, watermark, page numbering, and signing is designed to happen locally by default.
What pdfity still receives
Authentication data, usage counts, billing state, and operational telemetry are used to run the product, enforce limits, and support accounts.
What only happens by explicit choice
Drive imports, Dropbox saves, and Paddle checkout are optional boundary crossings triggered by the user, not silent defaults.
What this does and does not mean
It means standard processing is not upload-first by default.
It does not mean every external dependency disappears.
It means the third-party boundaries are explicit instead of hidden.
It does not replace a team's own regulatory, legal, or security review.