Where the document actually goes
Uploading your file is the step most PDF tools never mention. This one does not, and the honest version of that sentence has an exception in it. Both are below.
Text edits, form values, passwords and signatures sit in an edit session. Undo them, redo them, or throw the lot away; the file you opened is untouched until you choose Save or Save a copy. The jobs that produce a new file, like compression and conversion, ask you where to put it.
A malformed document is the usual way a PDF tool gets broken into, so the part you can see does not open one. It hands the bytes to a separate worker, and PDFium loads only there, inside a Windows job object that caps what the worker can start, how much memory it takes and how long it runs.
Most operations rebuild the document, write one revision, then read the bytes back to check that only one is there. Signing into an existing field and countersigning are the exceptions: they append, because that is the only way to leave an earlier signature covering what it signed.
One revision is not a clean one. Cropping hides rather than deletes; metadata, attachments and anything outside the crop box are still in the file. Redact removes content for good, but it is a separate decision you make on purpose - saving a single revision is not the same as removing anything.
This application has no server. No account, no sync, nothing in it that sends a document anywhere. A separate cloud product is planned under the same name, and does not exist yet — if you ever use that one you are uploading on purpose, and this application is not involved.
Turn on airplane mode. Every feature still works, apart from the optional timestamp on a signature, and you are the one who turns that on. A separate helper asks a time authority you pick to attest the hour: it sends a hash of the signature, never the document. That authority sees the request and has its own data policy.
There is no code in this application that makes a network request. The build asserts it. You are also free to look for yourself: an MSIX is a zip file, and the import tables inside it are readable with the tools a developer already has. They will not settle the question either way, which is the honest thing to say before you go and read them — and here is what you will find. tesseract.dll imports getaddrinfo, through a dependency of the OCR stack. No OCR feature reaches it, and an import is not a call. Better you read that here than find it yourself.
What we will not claim: Windows does not enforce a network boundary for a full-trust desktop application, so this is a statement about our code and not about what the system permits. We collect no telemetry. Windows crash reporting can still send diagnostics to Microsoft, possibly including data from an open document, and that is not ours to switch off.
Where the download stands
Free for personal and commercial use.
Built for Windows 10 and 11.