Check for yourself that files never leave

PDF911 uses a browser security policy (CSP) that blocks sending any data to addresses other than this site. Here is how to confirm it.

1. Press F12 (Cmd+Option+I on Mac) to open developer tools.
2. Open the Network tab and clear it.
3. Run a PDF task.
4. Look at the request URLs. Every request goes to pdf911.app, and the only one that sends data is /e.
5. Click the /e request and open Payload: it contains only a small JSON like the one below.

Example sent to /e

{
  "v": 1,
  "e": "tool_done",
  "lang": "en",
  "ret": {
    "returning": true,
    "visits_b": "2-5",
    "days_since_first_b": "1-7",
    "cohort_week": "2026-W43"
  },
  "p": {
    "tool": "merge",
    "duration_b": "1-5s",
    "output_size_b": "1-10MB"
  }
}

Security policy in effect

In the Network tab, check the Content-Security-Policy response header of the page.

default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; worker-src 'self' blob:; connect-src 'self' blob:; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'