Every day, millions of people merge, compress, and convert PDFs using free online tools. Most never ask the obvious question: when you click "upload," where does your document actually go â and who could read it along the way?
It is a fair question, because PDFs are rarely just paperwork. They are signed contracts, medical results, bank statements, tax returns, passport scans, and legal filings. This article looks â factually, and with sources â at what the most popular online PDF tools do with your files, and explains the one architectural distinction that changes the answer entirely: whether your file is uploaded to a server or processed on your own device.
The short version: The big names (iLovePDF, Smallpdf, Adobe) are reputable companies with strong security and clear deletion policies. But all three upload your file to their servers to process it. A client-side tool never uploads the file at all â which means there is nothing on a server to breach, retain, subpoena, or forget to delete. That is the difference this article is about.
Two ways an "online" PDF tool can work
The phrase "online PDF tool" hides two completely different architectures, and the privacy implications could not be further apart.
1. Server-side processing (the traditional model)
You select a file, your browser uploads it over an encrypted connection to the company's servers, the server does the work (merge, compress, OCR, convert), and the result is sent back for you to download. Your document physically leaves your device and sits â however briefly â on a computer you do not control. This is how most well-known tools work.
2. Client-side processing (the browser-only model)
The page loads a piece of software into your browser, and all the work happens locally on your own machine using JavaScript and WebAssembly. Your file is opened, edited, and saved without ever being sent anywhere. If you disconnected from the internet after the page loaded, it would still work. This is the model ContinuePDF is built on. We explain the mechanics in depth in How client-side PDF processing works.
What the popular tools actually do with your files
To keep this honest, every claim below is taken from each company's own published documentation, linked in the references at the end. None of this is speculation, and none of these companies are doing anything they hide â the details are public. The point is simply that the details matter.
iLovePDF
iLovePDF processes files on its servers. Your file is uploaded over HTTPS, processed, and returned. According to iLovePDF's own security page, the company is EU-based and GDPR-compliant, encrypts data in transit and at rest, and states that "all files processed within our platform are automatically and permanently deleted within two hours of being processed." It also notes one exception: signed documents are retained for up to five years to meet legal requirements.
Smallpdf
Smallpdf also processes files on its cloud servers, located in the EU, and operates as a Swiss company with ISO 27001 certification and GDPR/CCPA compliance. Files are transferred using 256-bit TLS encryption. On file retention, Smallpdf states that for free tool usage, "files are permanently removed from our servers after one hour of processing."
Adobe Acrobat online tools
Adobe's Acrobat online services upload your files to Adobe cloud storage â Adobe states this plainly in its FAQ. If you are signed in, your file is saved to your Adobe account. If you are not signed in, Adobe says it deletes the file from its servers "within a short time period" after you use a tool. Files are protected with AES-256 encryption and TLS 1.2, and uploaded files are labeled Private by default.
Client-side tools (the different model)
A genuinely client-side tool does not have a retention policy for your document â because it never receives it. There is no upload step, no server-side copy, and nothing to delete. The privacy guarantee comes from architecture, not from a promise.
Side-by-side: how the models compare
| Tool | File uploaded to a server? | Stated retention | Encryption | Jurisdiction |
|---|---|---|---|---|
| iLovePDF | Yes | Auto-deleted within 2 hours of processing (signed docs kept up to 5 years) | HTTPS in transit + at rest | EU (GDPR) |
| Smallpdf | Yes | Free usage: deleted 1 hour after processing | 256-bit TLS | EU servers / Swiss company |
| Adobe Acrobat online | Yes | Saved to account if signed in; deleted "within a short time period" if not | AES-256 + TLS 1.2 | Adobe cloud |
| Client-side tool (e.g. ContinuePDF) | No â processed in your browser | Nothing to retain; file never leaves your device | File never transmitted | Your own device |
Figures reflect each provider's publicly published policies as of July 2026. Policies change â always check the source links at the end for the current wording.
"But they delete the files â so what's the actual risk?"
This is the right question to ask, and the honest answer is: for a lot of documents, the risk is low, and these companies take security seriously. But "low risk" is not "no risk," and the difference is worth understanding before you upload something sensitive.
- A deletion policy is a promise, not a proof. When a file is deleted after one or two hours, you are trusting that the deletion happened, that no backup copy lingered, and that no process read the file in the meantime. That trust may well be justified â but it is trust, and you cannot verify it.
- There is a window where the file exists on someone else's computer. Between upload and deletion, your document sits on infrastructure you do not control. Any exposure in that window â a misconfiguration, an insider, a compromised dependency â is a window that simply does not exist if the file was never uploaded.
- Encryption in transit protects the road, not the destination. TLS stops someone intercepting the file on its way to the server. It does nothing to limit what the server operator can do with the file once it arrives and is decrypted for processing.
- Jurisdiction and legal requests apply to stored data. A file on a company's servers can, in principle, be subject to legal process. A file that only ever existed in your browser cannot.
- "Deleted" sometimes has exceptions. As iLovePDF's own policy shows, signed documents are kept for years for legal reasons. Account-based flows (like signed-in Adobe usage) deliberately store your file. The default is not always the whole story.
The safest data is the data that was never collected. If your file never leaves your device, there is no breach that can expose it, no retention window to worry about, and no policy you have to take on faith.
When server-side is fine â and when it isn't
None of this means you should never use a server-based tool. It means you should match the tool to the sensitivity of the document.
Server-side is usually fine for: public documents, marketing PDFs, a class handout, a manual you downloaded anyway â anything you would not mind a stranger seeing.
Prefer client-side (or offline desktop software) for: signed contracts, medical and health records, bank and tax documents, legal filings, passport or ID scans, anything under NDA, and any file containing other people's personal data that you are responsible for protecting under GDPR, HIPAA, or similar rules.
Rule of thumb: if you would hesitate to email the file to a stranger, do not upload it to a server to process it. Use a tool that keeps it on your device.
How to tell whether a tool uploads your file
You do not have to take any website's word for it â including ours. You can check for yourself in about a minute:
- The airplane-mode test. Load the tool's page, then turn off your internet connection (airplane mode, or unplug/disable Wi-Fi). Now try to process a file. If it still works offline, the processing is happening on your device. If it fails, it needed a server.
- The network-tab test. Open your browser's developer tools, go to the Network tab, and perform the operation. If you see a large upload request (often a
POSTwithmultipart/form-dataroughly the size of your file), it was uploaded. - Read the policy. Search the privacy policy for words like "upload," "server," "retention," and "delete." A client-side tool has little to say there because it does not receive your file.
We wrote a full, step-by-step walkthrough of these checks â with what to look for in each case â in How client-side PDF processing works (and how to check if a site uploads your files).
The bottom line
iLovePDF, Smallpdf, and Adobe are legitimate, security-conscious companies, and for everyday documents their tools are perfectly reasonable to use. But every one of them works by uploading your file to a server, which means their privacy ultimately rests on a promise you cannot independently verify. Client-side processing removes the promise from the equation: the file stays on your device, so there is nothing to leak, store, or trust.
If you want to keep sensitive documents on your own machine, ContinuePDF runs entirely in your browser â you can merge, compress, split, sign, and more without your file ever being uploaded. Or, if you would rather understand the technology first, read the companion piece on how client-side PDF processing actually works.
Sources
- iLovePDF â Security & Data Protection: ilovepdf.com/help/security
- iLovePDF â Privacy Policy: ilovepdf.com/help/privacy
- Smallpdf â Is Smallpdf Safe? (retention & encryption): smallpdf.com/blog/is-smallpdf-safe
- Adobe â Acrobat online services FAQ (uploads & deletion): helpx.adobe.com