Your file is copied over the network to a server, written to disk, processed, and left in place until a cleanup job removes it. Along the way it usually passes through a CDN and gets captured in logs and backups, which is why deletion is more complicated than a single delete call.
Every online converter has a privacy page, and they mostly say the same reassuring thing. Far fewer describe the actual path a file takes. That path is worth understanding, because it explains why some of the reassurances are easy to give and hard to keep.
The journey, step by step
1. The file leaves your device
Your browser reads the document and sends it as an HTTP request. Over HTTPS this is encrypted in transit, which protects it from anyone watching the network — but not from the destination, which is the whole point of sending it there.
2. It usually passes through a CDN
Most services sit behind a content delivery network for speed and protection. Your upload therefore transits a third party the service chose, which may terminate the encryption and may operate in a different country from the company you thought you were dealing with.
3. It is written to disk
Processing needs a real file. It is written to storage — often shared storage, so it can be picked up by whichever worker machine is free. At this moment your document exists as an ordinary file on a computer you have never seen.
4. It is processed, producing a second copy
The conversion writes an output file. There are now at least two copies of your content on their infrastructure, and the output is typically kept longer, because you have to be able to download it.
5. It waits for cleanup
Deletion is almost never immediate. A scheduled job removes files older than some threshold. Between conversion and cleanup, both copies sit there — and if the job fails, they sit there longer, quietly, because nothing alerts on files that were supposed to disappear.
Why "deleted after one hour" is harder than it sounds
Assume total good faith. The company means it. Deletion is still genuinely difficult, because a file is rarely in only one place:
Backups. Storage is backed up, and a nightly snapshot taken before cleanup contains your file for as long as that backup is retained — often weeks.
Logs. Filenames, sizes and timestamps end up in application logs. The content may be gone while a record that you converted "2026-tax-return.pdf" persists.
Caches. A CDN may have cached the download so a retry is fast, on machines the service does not directly manage.
Replication. Redundant storage keeps copies across locations; deletion has to propagate to all of them.
None of this is sinister. It is what running reliable infrastructure looks like. But it means "your file is deleted after an hour" describes an intention about primary storage, not a guarantee that no copy exists anywhere.
What you can actually verify
You cannot audit a company’s cleanup jobs. You can determine whether an upload happened at all, and that single fact settles every question above.
Open developer tools, go to the Network tab, and choose a file. A large outbound request means it was uploaded.
Or simply disconnect from the network after the page loads and try the conversion. If it works, nothing was sent.
One caveat when you try this here: this site shows adverts, so the Network tab lists requests to Google’s ad domains. They are small, they carry no document data, and they are unrelated to the conversion — the disconnect test settles it either way, because with the network off the adverts fail and the conversion still finishes.
The architecture that avoids all of it
If the file never leaves your device, none of steps one to five occur. There is no transit, no CDN, no disk, no second copy and no cleanup job — not because the operator is careful, but because there is nothing to be careful with.
Browsers can now do this work directly: reading ZIP containers, parsing document formats, rasterising PDFs and encoding images all run locally at usable speed. That is how the tools here are built, and why they keep working offline.
Server-side processing is not a scam, and it buys real things: heavier operations like OCR, consistent results regardless of your device, and files that persist so you can come back for them. If you need those, a server is the right answer.
The mistake is uploading by default — handing over a payslip or a signed contract because uploading is what the first search result happened to do. For most everyday document work, the upload buys you nothing you would have missed.