It depends entirely on whether the tool uploads your file. Most do: your document is copied to a server, processed there, and stored for some period afterwards. For a holiday photo that is fine. For a contract, a payslip or medical records, you are handing a complete copy to a company you have not vetted.
Nearly every free converter works the same way. You choose a file, your browser uploads it, a server does the work, and you download the result. The conversion is genuinely free. What you paid with was a complete copy of your document.
That is not a scandal in itself — it is simply how server-side software works. The question worth asking is what happens to the copy, and whether the document you converted was one you would have emailed to a stranger.
What actually happens to an uploaded file
Once your file leaves your device, four things are true whether or not the service is well run:
It exists on hardware you do not control, at least briefly, and usually on more than one machine once backups and caches are counted.
It is readable by the operator. Encryption at rest protects against someone stealing the disk; it does not stop the company reading the file, because the company holds the key.
It is subject to that company’s jurisdiction, which may not be yours, and to any legal request made there.
Its deletion is a promise, not something you can verify. "Files are deleted after one hour" is a policy, and policies are followed by people and cron jobs that sometimes fail.
Reputable services do handle this responsibly. The point is not that they are dishonest — it is that you are relying on a promise you have no way to check, for a document that may not be yours to gamble with.
When it genuinely does not matter
Plenty of documents carry no risk at all. A restaurant menu, a public form, a manual you downloaded from a manufacturer, a draft with nothing identifying in it — upload those anywhere you like. Convenience is a real benefit and the risk is close to zero.
When you should not upload
The line is worth drawing deliberately, because most people never draw it at all. Do not upload documents that contain:
Identity data — passports, driving licences, national ID numbers, birth certificates.
Financial detail — bank statements, payslips, tax returns, invoices with account numbers on them.
Medical records, of any kind, for anyone.
Signed contracts, legal correspondence, or anything covered by a confidentiality clause.
Work documents belonging to your employer or a client, where you are not the one entitled to decide where they get stored.
How to tell whether a tool uploads your file
Marketing copy is not evidence. "Secure", "private" and "your files are safe with us" all describe how a server handles an upload, not whether one happened. Two checks settle it in under a minute.
Check one: watch the network
Open your browser’s developer tools, switch to the Network tab, then choose your file. If you see a request carrying several megabytes upward, the file was uploaded. If nothing of the sort appears, it was not.
Check two: disconnect
Load the page, turn off your Wi-Fi, then try the conversion. A tool that works entirely in your browser will finish normally. A tool that needs a server will stall or fail. This is the more convincing test, because it cannot be faked by a reassuring privacy policy.
Check three: read the code
The strongest check of all, and one most converters cannot offer — their processing happens on a server you will never see. This site can: its source is published in full, so anyone can read exactly what happens to a file rather than trusting a description of it. There is a link on the about page.
The alternative: tools that never upload at all
Browsers have quietly become capable enough that the upload is no longer necessary for most document work. A modern browser can unzip archives, parse the OpenXML inside a .docx, rasterise a PDF, encode images and run cryptography — all locally, at usable speed.
That means a converter can be written to read your file into memory in the tab and do the work there. Nothing is transmitted, so there is no copy to retain, no policy to trust and no jurisdiction to worry about. The privacy is a property of the architecture rather than a promise about conduct.
That is how every tool on this site works, and it is why they keep working with the network disconnected once the page has loaded. You do not have to take that on trust — run the two checks above on this site and see for yourself.
Local processing is not free of trade-offs, and any tool claiming otherwise is overselling. Three honest limits:
Your device sets the ceiling. A very large file may fail on a phone and succeed on a laptop, because the work happens in your browser’s memory rather than on a server with room to spare.
Scanned documents need OCR, which is heavy. A scan is a picture of text, and reading it requires software this kind of tool may not include.
Anything genuinely requiring a server — sending an email, storing a file for later, collaborating with someone else — cannot be done locally by definition.
The short answer
Online PDF converters are safe enough for documents you would not mind a stranger reading, and a genuine risk for everything else. The useful move is not to find a service with a better privacy policy — it is to use a tool that never receives the file, so the policy stops mattering.
If you want to see what that looks like in practice, the full toolkit runs entirely in this tab, and the privacy page sets out exactly what is and is not stored.