Privacy & Security Architecture
SAVY Privacy Guarantee
Transparent technical disclosure regarding how your files are processed locally in your browser.
Official Privacy Commitment:
"Your PDF is processed locally in your browser and is never uploaded to SAVY servers."
1. How Local PDF Processing Works
Traditional PDF tools upload your sensitive documents, financial records, contracts, and personal IDs to their remote servers for cloud processing.
SAVY is engineered differently. Using modern WebAssembly, HTML5 Canvas, and client-side JavaScript engines (Mozilla's PDF.js and pdf-lib), all PDF parsing, page rendering, annotation burning, merging, splitting, watermarking, and redaction execute entirely within your computer's browser memory.
2. Data Transmission to SAVY Servers
SAVY does not operate a document processing backend, cloud storage buckets, or remote analysis databases.
- Your PDF files are never transmitted to a SAVY server.
- Your signatures, annotations, and drawn strokes are never transmitted.
- Your extracted text and metadata are never transmitted.
- All exported documents are compiled in RAM and downloaded directly to your local file system.
3. Network Requests & Content Delivery Networks (CDNs)
While your document contents never leave your device, your browser makes standard HTTPS requests to public Content Delivery Networks (CDNs) to download the open-source client libraries necessary to run the workspace:
| Library / Asset | Source / CDN | Purpose | Data Sent |
|---|---|---|---|
| PDF.js (v3.11.174) (Mozilla) | cdnjs.cloudflare.com | Client-side PDF document parsing, text extraction, and canvas rendering | None (Static library code downloaded only) |
| PDF.js Worker (Mozilla) | cdnjs.cloudflare.com | Web Worker thread for non-blocking PDF page rendering | None (Static worker code downloaded only) |
| PDF.js CMaps (Mozilla) | cdn.jsdelivr.net | Character glyph font mappings for non-Latin and CJK PDFs | None (Static CMap files downloaded as needed) |
| pdf-lib (v1.17.1) | cdnjs.cloudflare.com | Client-side PDF page assembly, merging, splitting, metadata, forms, and export | None (Static library code downloaded only) |
| Tesseract.js (v5.1.0) | cdn.jsdelivr.net | Optional, lazy-loaded client-side OCR engine running in WebAssembly (only loaded if user requests OCR) | None (Wasm binary & language training data downloaded to device) |
| Application Shell Assets | SAVY Static Host | Static HTML, CSS, JavaScript modules, SVG icons, and manifest | None (Standard HTTP GET requests for static files) |
These requests download client software to your browser. Your PDF documents and contents are never attached to or sent with any of these requests.
4. Browser Storage & Memory Lifecycle
SAVY uses browser storage minimally and strictly for functional execution:
- Landing Page Handoff (IndexedDB): When you drop a PDF on the landing page, it is temporarily held in local browser memory (IndexedDB database
SAVY_LOCAL_STORE) to hand off to the editor tab. The handoff record is automatically deleted immediately upon retrieval by the editor. - No LocalStorage of PDFs: SAVY does not store PDF binaries or personal document data in persistent
localStorageorsessionStorage. - Object URLs: All temporary browser memory Blob URLs are tracked and revoked upon document switch, export completion, or document closure.
- Document Reset: Using the "Close Document" button cancels background render tasks and purges active document models from memory.
5. Cookies, Analytics & Telemetry
Codebase audit confirms:
- Zero Tracking Cookies: SAVY sets no tracking, advertising, or profiling cookies.
- Zero Third-Party Analytics: No Google Analytics, Facebook Pixels, or telemetry scripts run in the application.
- Zero User Profiling: We do not know who you are, what documents you view, or what edits you make.
6. Document Security Capabilities & Limitations
To maintain transparency, SAVY clearly outlines what our client-side architecture can and cannot do:
- Visual Redaction: Burns solid opaque black boxes over selected coordinates. Note: underlying vector text in complex PDFs may remain extractable by text search unless Sanitized Redaction is used.
- Sanitized Redaction: Rasterizes redacted pages onto high-DPI canvas to permanently destroy underlying text tokens from the PDF stream.
- PDF Encryption / Passwords: Standard client-side
pdf-libdoes not support native PDF password encryption. True PDF encryption requires an additional compatible client-side PDF encryption implementation. SAVY will never pretend to encrypt files. - Client-Side AI: AI summary, Q&A, key points, and outline detection run in local browser memory via TextRank, BM25, and local heuristic parsing. When hardware acceleration or Chrome's Built-in Prompt API (
window.ai) is available, it executes purely on local device silicon. User PDFs are never sent to external AI servers.
7. Open Governance & Source Code
SAVY is built on open web standards. If you have questions about our local processing architecture or privacy disclosures, please review the project repository.