A friend of mine works in HR. Every month she edits a stack of PDFs — offer letters, salary slips, resignation forms, medical claim reimbursements. Most months, she does it on whatever online tool shows up first in Google. Merge, split, redact, sign. Two clicks and a download.
When I asked her, half-joking, whether she'd read any of those tools' privacy policies, she laughed. Nobody reads privacy policies. That's the whole business model.
I want to walk you through what actually happens when you upload a private document to a random PDF site, because once you see it, you can't un-see it — and the alternative is genuinely simple.
The five seconds after you click upload
Your file leaves your computer, travels through your ISP (which sees the domain), reaches the tool's servers, and gets written to a disk. In that moment it becomes their asset — physically, legally, contractually. Most sites will happily tell you they "delete files after one hour". Some do. Some don't. You have no way to check.
While the file sits on that disk, several things almost always happen: the server extracts the text for its own logs, an antivirus scanner reads the whole thing, an analytics job might tag it ("this file mentions a bank account, a salary, an address") and store those tags forever, even after the file itself is deleted. The file goes; the metadata stays.
What the fine print actually says
I sat down one afternoon and read the privacy policies of the ten most popular free online PDF tools. Nine of them contain some version of this sentence: "We may retain metadata and derived information to improve our services." One of them explicitly reserved the right to use uploaded content for "training and product development".
In plain English: your contract might be a training example for someone's classifier. Your medical report might be a row in someone's analytics dashboard. Legally, you agreed to this the moment you clicked upload.
The special case of "redact"
Redaction is the worst offender. When you "redact" a name on most online tools, they draw a black rectangle over it and save the file. The underlying text is still there — hidden but present. Copy and paste from the "redacted" PDF and the original text pops out.
This is not theoretical. In 2019, the Manafort court filings were released with black rectangles over sensitive names. Within an hour, reporters had extracted every one of them by copy-pasting. The tool used was a mainstream PDF editor. The mistake is easy to make and almost impossible to spot by eye.
A real redaction has to rasterise the page — turn it into a flat image — and re-embed it. Bluebird's PDF Redact does exactly that, in your browser. When you download the file, the text is gone. Verified with a hex editor, if you're feeling paranoid.
How Bluebird handles PDFs, step by step
The moment you drop a PDF onto a Bluebird tool, it's loaded into a private memory buffer inside your browser tab. From that point on, three libraries do the work: pdf-lib for structural edits (merge, split, add pages), pdf.js for rendering, and a small in-house wrapper that handles things like flattening annotations before export.
When you click download, the browser assembles the result and offers it back to you. There is no network call in between. You can prove it: open your browser's Network tab, filter for anything going out, and watch. Silence.
The one caveat: the first time you open a tool, the browser downloads the tool itself (a few hundred kilobytes). After that, it works offline. I've merged expense receipts on a flight to Bangalore with the wifi turned off.
A short checklist for any PDF tool you use
1. Before uploading anything sensitive, open the Network tab of your browser. Drop a small dummy file. If you see a request going to another domain with your file's size, the file just left your machine. Look elsewhere.
2. Prefer tools that show a preview of your document immediately after you drop it. Previews mean the file is already in your browser and doesn't need a server round-trip.
3. Read the phrase used on the landing page. "Files deleted after an hour" means files are being kept. "Runs in your browser" or "nothing is uploaded" is the phrase you want, and the Network tab is how you verify it isn't a lie.
4. For redaction specifically, test the output. Open the downloaded file, try to copy the text from the redacted region, paste it into a text editor. If anything comes out, throw the file away — it isn't redacted.
You don't need to be paranoid to care
Nobody is worried about the wedding invitation. But most people, over a year, will handle at least a few PDFs that would embarrass them or endanger someone if they leaked — a rental agreement, a bank statement, a doctor's note, a passport scan for a visa application. The friction between "private" and "public" is one accidental upload.
The good news is that the tools to keep those files on your device are here, they're free, and they're not slower than the upload-based ones. There's no trade-off left. There's just a habit to change.
