Is Universal PDF Safe? How We Handle Your Files
By the Universal PDF Team · Published · Updated · 6 min read
Universal PDF is designed so that we handle as little of your data as possible. Many of our tools process files entirely in your browser, so those files never leave your device at all. A small number of AI-powered tools are the exception: they upload your file, and the extracted text or audio is sent to a third-party AI provider to generate a result. When a conversion does need server processing, it travels over an encrypted connection. Here is exactly how it works, including what we can and cannot promise.
Do my files get uploaded when I use Universal PDF?
It depends on the tool. There are three kinds, and here is exactly how each one handles your file.
Browser-local tools. Tools like Merge PDF, Split PDF, Edit PDF, Sign PDF and JPG to PDF run entirely in your browser using JavaScript. Your file is opened and processed on your own device. It is never transmitted to us, we cannot see it, and there is nothing for us to delete afterwards. Nothing uploads unless you explicitly choose to email your result or save it to My Files.
Server-powered tools. Some jobs need more processing power than a browser can provide: PDF to Word, Compress PDF, OCR, and most audio, video and ebook conversions. For those, your file uploads over an encrypted TLS connection, is processed, and is then handled according to the retention rules below.
AI-powered tools. PDF Summarizer, Book Summarizer, Translate, Transcribe Audio and Transcribe Video upload your file like a server-powered tool, and also send the extracted text or audio to a third-party AI provider so it can generate your result. That provider does not use your content to train its models.
How long do you keep my files?
| Situation | What happens to the file |
|---|---|
| Browser-local tool | Never uploaded. The file stays on your device; there is nothing for us to keep. |
| Server or AI tool | Uploaded over an encrypted connection and kept only as long as needed to provide the service. Files in your account are yours to delete anytime from My Files, and you can also request deletion. |
Files you upload are held in private, access-controlled storage, and we do not read, analyze, or share the contents of your files ourselves. For AI-powered tools, the extracted text or audio is sent to a third-party AI provider to generate your result; that provider does not use it to train its models either. The full details are in our Privacy Policy.
What personal data do you store?
If you use the tools anonymously: essentially nothing beyond what is needed to run the job. If you create an account, we store your email address and authentication details through our provider, Supabase. We use essential cookies to keep you signed in; with your consent, we also use analytics and advertising cookies (such as Google, Meta and Microsoft Clarity) to measure our ads and understand usage. You can decline or change these anytime from “Cookie settings” in the footer, and we honor Global Privacy Control signals.
If you subscribe to Pro, payment is handled by Stripe. Your card number goes directly to Stripe and never passes through us; Stripe shares only your subscription status and billing contact details with us. We do not sell personal data to anyone.
How can I verify the browser-local claim?
You do not have to take our word for it. Two easy checks:
- The offline test. Open a browser-local tool like Merge PDF, wait for the page to load, then disconnect from the internet (airplane mode works). The merge still completes, because everything happens on your device.
- The network tab.Open your browser's developer tools, switch to the Network tab, and run the tool. For browser-local tools you will see no request carrying your file.
What can't you promise?
Honest security pages include the limits, so here are ours:
- Server tools are not end-to-end encrypted.To convert a file, the server has to process it in readable form. Encryption protects the file in transit (TLS), and at rest it's held in private, access-controlled storage, but during processing the server necessarily works with the actual content. AI-powered tools go further: the extracted text or audio also reaches a third-party AI provider to generate the result. If a document is sensitive enough that no third party should ever technically be able to process it, use one of our browser-local tools. Or don't upload it anywhere, to any service.
- Your device is your responsibility. Browser-local tools are only as safe as the device they run on. Malware or browser extensions with broad permissions on your machine can see anything you open there (that is true for every website).
- We are a small product, not a compliance platform. We do not currently advertise certifications like SOC 2 or ISO 27001. If your organization requires certified vendors for regulated data, check that requirement before using any online converter, including ours.
Do I need an account to use the tools?
Yes: running the tools and downloading results is part of the Pro subscription, and a subscription needs an account. One subscription unlocks every tool on the site, and you can cancel anytime. In privacy terms, an account means we hold your email address and Stripe holds your billing details, and nothing more. The file-handling rules above don't change: browser-local tools still process files entirely on your device, and server-processed files are handled as described above. Signing in also gets you My Files, where your results are saved for re-download, and you can delete anything in it yourself at any time.
Is the site itself safe to use?
The site is served over HTTPS, accounts are handled by Supabase (a widely used authentication provider), and payments never pass through our infrastructure. Stripe processes them directly, so we never see your card number. The only things you are trusting us with are an email address and the files you choose to process, and the sections above spell out exactly how those files are handled.
The short version
- Many tools process your file entirely in your browser and never upload it at all.
- Server conversions travel over TLS and are kept only as long as needed to provide the service.
- Your files stay in My Files, in your account, and are deletable anytime.
- We never read, share, or train on your file contents ourselves; AI-powered tools send text or audio to a third-party AI provider that doesn't train on it either.
- Stripe handles payments; we never see your card number.
- Server and AI-powered tools are not end-to-end encrypted, so for maximum privacy prefer the browser-local tools.
- One Pro subscription covers every tool, including downloading your results.
Questions we didn't answer here? Email support@universalpdf.com and a human will reply.