Security & Privacy

🔒 Local-First Architecture

Your PDFs never leave your device.

PrivDF reads and edits PDFs in your browser using modern Web APIs (PDF.js, Web Crypto, IndexedDB). When you open a PDF it goes straight into your browser's memory—there is no upload endpoint to receive it.

Data we never collect: PDF files, document text, filenames, annotations, passphrases, API keys, AI prompts. What we do collect is listed under "What data do you collect?" below.

🔐 Client-Side Encryption

AES-256-GCM, keyed from your passphrase. Here are the exact parameters.

All highlights and notes are encrypted before they are written to your browser's IndexedDB, using the Web Crypto API. The passphrase never leaves your device and we have no copy of it, so we cannot decrypt your data.

• ✓ Cipher: AES-256-GCM (authenticated — tampering is detected, not silently decrypted)
• ✓ Key derivation: PBKDF2-HMAC-SHA-256
• ✓ Iterations: 600,000 (current OWASP guidance). Records written before this bump used 100,000 and store their own count, so they still open.
• ✓ Salt: 16 random bytes, generated fresh per record
• ✓ IV/nonce: 12 random bytes, generated fresh per record
• ✓ Key handling: derived in memory, marked non-extractable, never written to disk and never sent anywhere
• ✓ Encrypted: annotation contents, notes, and exported archives
• ✓ Not encrypted: the file-hash value used locally to match annotations back to the right document (a hash of the file, not its contents)

⚠️ What PrivDF Does Not Protect Against

An honest boundary is worth more than a longer list of promises.

PrivDF is designed so that a PDF vendor—us—never holds a copy of your documents. That is the threat it removes. It does not defend against:

• • Malware or a compromised operating system on your own machine
• • Malicious or over-permissioned browser extensions, which can read any page you open
• • Someone with physical access to an unlocked device
• • A forgotten passphrase — there is no recovery path, by design
• • Whatever your AI provider does with text you knowingly send it
• • Every conceivable supply-chain attack on the browser or its dependencies

For the strongest boundary, use the signed, notarized desktop build: it is a pinned binary rather than code re-delivered by a server on every visit.

🤖 Privacy-Respectful AI

Only extracted text is sent to Venice AI—never your PDF file.

AI is the one feature in PrivDF that reaches the network. Text is extracted from your PDF locally, and only the passage relevant to your question or summary is sent to Venice.ai, which operates a zero-retention policy. The file itself is never part of the request.

Two important caveats we would rather state plainly: the text you send is processed in plaintext by the provider during inference, and AI features are opt-in — no text is transmitted until you invoke them.

You do not need a Venice account or API key of your own. Free use includes 5 AI operations per day on our provisioned Venice capacity; Pro ($4.99/month) raises that limit.

👁️ Privacy Inspector

See what has left this device this session — measured, not claimed.

Open the Privacy Inspector from the toolbar and it shows exactly what left your device, built the same way we’d want a skeptic to check: it instruments the browser’s own network primitives (fetch, XMLHttpRequest, sendBeacon) rather than asking you to trust that our own code reports itself honestly. Every outbound request is logged with its timestamp, destination, purpose — AI, account, payment, analytics or app update — and byte size. The request body itself is never recorded; a privacy panel that logged your data would be its own privacy problem.

Scope, stated plainly: this covers every request JavaScript can send, which is every channel that could carry a document out. It does not separately log the page’s own scripts, images and fonts loading — but those carry no request body, so they cannot carry your file either.

Strict Offline Mode, right below it, is one switch that blocks every outbound request — AI, account, payment, analytics and update checks alike. Editing, redaction, signing, OCR and export all keep working, because they never needed the network. Turn it on and watch the Inspector’s counter stay exactly where it was.

📄 OCR Reads Scans On Your Device, By Default

Scanned pages are read locally by Tesseract — no upload, no AI quota, no limit.

Scans and photographed pages are OCR’d in a Web Worker on your device by default. The OCR engine itself is served from privdf.ai rather than a third-party CDN, so no outside party learns you’re reading a document at all. In the desktop app the engine is bundled in, so it works with the network switched off from the moment you install; on the web it downloads once and is cached after that, so it works offline too.

One accuracy upgrade does send data: on a dense or multi-column scan, you can ask AI to re-read a single page. Only then does that page’s image leave the device, and only that page counts against your AI quota. Pro accounts default to the AI read, since their quota is unlimited — there’s a switch in the OCR banner to turn that off and stay on-device, and Strict Offline Mode overrides it either way.

🛡️ Security Headers

Industry-standard HTTP security headers.

• ✓ Content Security Policy (CSP) - Prevents XSS attacks
• ✓ Strict Transport Security (HSTS) - Forces HTTPS
• ✓ X-Frame-Options - Prevents clickjacking
• ✓ X-Content-Type-Options - Prevents MIME sniffing

🗑️ Complete Data Deletion

Delete everything with one click.

The "Delete All Data" button in the app wipes all annotations, cache, API keys, and settings from your browser's storage. We can't recover it because we never had it.

📦 Portable Exports

Your data, your control.

Export your PDFs with encrypted annotations as ZIP files. Move them to another device, back them up, or delete the local copies. You're never locked in.

1. Watch the network. Open your browser's DevTools → Network tab, then open a PDF and edit, redact or sign it. No request carries your file. Trigger an AI action and you will see exactly one request, to Venice, carrying text.
2. Pull the plug. Load PrivDF, then disconnect from the network. Opening, annotating, redacting, signing and exporting keep working. Only AI stops.
3. Or skip DevTools. Click the Privacy Inspector icon in the app's toolbar for the same information without leaving the page. Flip on Strict Offline Mode there and every other tool keeps working while the request count stays at zero.
4. Inspect what is stored. DevTools → Application → IndexedDB → pdf-ai. Annotation records are ciphertext; there is no plaintext copy of your notes.
5. Verify the desktop build. Every release on the download page publishes its SHA-256 checksum, Apple Team ID and notarization status, so you can confirm the binary you got is the binary we shipped.