Verify PDFs stay on this device

LocalPdfMerge merges and splits PDFs in the browser. This page is the check you can run yourself: which network calls are normal, and which calls would mean the document left the tab. The tool is on the home page. The short policy is the privacy policy. The copyright and rights rules are the terms. Publisher context is on about.

What you are proving

You are proving that merge and extract do not upload the PDF. You are not proving that nothing on your computer can see the bytes. A browser extension, malware, or a recorder you installed can still read a tab. This site does not receive the file, and it does not claim to block other software on the device. Files never leave this device through this page.

If Network shows a POST or PUT of your PDF, stop using that session and write to contact@localpdfmerge.pages.dev with the page URL and what you saw — without attaching the document. That would not match how this tool is built.

Steps in DevTools

1. Open the merger. Use a small PDF you are allowed to test with, not a sensitive contract, the first time you learn the panel.
2. Open DevTools → Network. In Chrome that panel is documented as the Network panel. In Firefox it is the Network Monitor. Enable “Preserve log” so a reload does not wipe the list.
3. Reload the page once and let the first requests finish. You should see same-origin GETs for the document, /assets/styles.css, /assets/tool.js, /assets/vendor/pdf-lib.min.js, and the favicon.
4. Drop the PDF (or several on Merge). Wait until the list or page count appears. Sort or scan the new rows. There should be no request whose body is that file, and no POST or PUT of the PDF to this host or any other host.
5. Merge or extract. Downloads use blob: URLs created in the tab. The browser is not fetching those bytes from our server.

Expected requests

• Page assets. HTML, CSS, tool.js, pdf-lib.min.js, and the icon — all GET, all from this site, when the page loads.
• pdf-lib. Same-origin GET of /assets/vendor/pdf-lib.min.js. That file is the MIT-licensed library that copies pages in the tab. It is not your document. Open the response: it is JavaScript.
• Analytics beacon, maybe. The privacy policy describes Cloudflare Web Analytics. If that product is enabled for the zone, a request to cloudflareinsights.com can show up. It is a page-view beacon. It is not an upload of the file you dropped. The HTML we ship does not include an advertising script.

Requests that should not appear

• A POST, PUT, or PATCH that carries the PDF bytes.
• A call to a third-party convert, OCR, or “AI merge” API after you drop the file.
• A fetch of a remote PDF URL. The tool has no address field and does not download documents from the web.
• A script load from an ad host. Response headers for this site set a Content-Security-Policy with script-src 'self' and do not list an ad network.

Why the file can stay in the tab

The drop area is a file input. The File API lets the page read a file the user chose. It does not give the page a path it can upload on its own later. pdf-lib loads the PDF into memory and copies pages into a new document. The download buttons point at object URLs from URL.createObjectURL. When you close the tab, that buffer goes with it. We have no project library to reopen.

Soft limits refuse files over about 25 MiB and batches over about 64 MiB. Encrypted PDFs may fail to load. That error is local. It is not an upload, and it is not a password bypass.

Publisher, contact, and policy pages

These pages stay on the existing URLs. They are how you learn who publishes the tool and how to reach us:

• About — who publishes the pages.dev experiment and what the tool is for.
• Contact — a working mailbox for wording and bugs, with clear “do not send PDFs.”
• Privacy — no PDF upload, hosting logs, optional Web Analytics, children note.
• Terms — your documents, acceptable use, honest limits.
• This trust page — a verifiable Network check for merge and extract.

This experiment does not run advertising scripts today. If that ever changes, privacy and about would need an honest update first.

Where to go next

• Merge or extract a PDF
• Merge without upload
• Split and extract ranges
• Reorder before merge
• Why local PDF tools matter
• About · Privacy · Terms · Contact

Questions about this wording, email contact@localpdfmerge.pages.dev. Do not attach the PDF. We cannot accept the file, and we do not want a private contract in a mailbox.