Your documents never leave your phone.

What OffPDF Mobile does with your documents

Your documents are never uploaded for processing. Every merge, split, compression, signature, watermark, page number, scan, text edit, Office conversion and text recognition happens on your phone. No document, no page, no scan and no extracted text is sent anywhere to be worked on, and there is no OffPDF server that could receive one.

That claim is about your documents, and it is deliberately not a claim that the app never uses the network. It does, for the things listed under When OffPDF uses the network, and none of them carries a document. A policy that promised more than that would be contradicted by the app's own download screen.

Four things hold the claim up, and each of them is a mechanism rather than a promise:

• Office documents are rendered inside a web view locked to about:blank, with caching and storage switched off, which refuses to load any address at all.
• Before that render, every remote reference in the file — a linked image, a remote stylesheet, a tracking pixel in a .docx someone emailed you — is stripped, and then its absence is checked. The check is not redundant: a stripper with a bug fails open, and failing open there is the worst thing that could happen in this product.
• Text recognition runs on the phone. Apple's Vision framework on iOS, Google's bundled ML Kit recogniser on Android. The Android model is inside the app, which is why the app is about 12 MB larger and why nothing has to be fetched to read a page.
• The AI runs on the phone. The model is downloaded once, and after that your questions and the document they are about are never transmitted — there is nowhere to transmit them to.

Two things do move a document off the phone, and both are you doing it: the share sheet, which hands the finished file to whichever app you pick, and printing, which hands it to the operating system and from there to a printer that may be on your network. Neither goes through OffPDF, and neither can happen without you choosing it.

Documents you import are copied into the app's own Documents folder so it can work on them. On iOS that folder is visible to you in the Files app. They stay there until you delete them, and deleting a document in the app deletes the copy.

Once per version of the app, after a file you made has been saved, shared or printed, or a question about a document has been answered, the store's own rating prompt may appear. It is Apple's dialog on iOS and Google's on Android, drawn by the operating system: OffPDF asks for it and is told nothing — not whether it was shown, not what you tapped, not whether you rated anything. No document, filename or setting is part of that request, and there is no button anywhere in the app that solicits it.

The app cannot update itself. Over-the-air updates are switched off in both builds, so the code that makes these promises is the code that came from the store.

Permissions, and why each one exists

The Android build has no storage permission. The system document picker and share sheet hand the app scoped access to the specific file you chose, which is narrower than storage access. The one wider access OffPDF can hold is a folder you hand it yourself, and even that is one folder, only ever read, and yours to take back — see One folder of yours below. "All files access" is not requested, and the build blocks it outright so that no library can add it.

Android's permission list is enforced by the operating system and printed on the Play listing, so the table above can be checked against Google's own text on the same page. iOS has no equivalent list; the nearest thing is Settings → Privacy & Security → App Privacy Report, which shows every domain an app has contacted.

One thing in the iOS build is a leftover rather than a feature, and it is written down here because you may see it before anyone explains it. The app carries a local-network description that names a development tool, because that tool is still a dependency of the released build. Nothing in OffPDF uses the local network for anything. If iOS ever asks you for local-network access on OffPDF's behalf, refusing costs you nothing.

One folder of yours, if you choose one

Files has a second view, On this phone, which can list one folder of your phone's — usually Downloads — so the PDF, Word, Excel and PowerPoint files in it are a tap away. Nothing about it is on until you turn it on.

• You choose the folder, in the system's own picker. On an iPhone that is the Files folder picker; on Android it is the system's document picker. It is not a permission prompt, and no storage permission is involved on either platform.
• One folder, read-only. To list it, OffPDF reads the names, sizes and dates of the files directly inside it — not its subfolders. It reads a file's contents only when you open that file or choose it for a tool. Nothing in OffPDF writes, renames or deletes anything in the folder. On Android the grant it keeps is read-only, so it could not if it tried; on an iPhone the system's folder access does not come in a read-only kind, and the promise rests on the app's code, which has no path that writes there.
• On Android 11 and later, not Download itself. Android does not let any app be given the Download folder as a whole, so you choose a folder inside it — WhatsApp Documents, for example — or another folder. Files in Download itself can still be opened through Browse, which lets you pick them one at a time and leaves OffPDF holding nothing afterwards.
• Opening a file copies it. A PDF is copied into OffPDF's own Documents folder, where it stays until you delete it; a Word, Excel or PowerPoint file goes to its converter, and a tool you send a file to works on a temporary copy. The original stays where it was, untouched.
• What is kept. On Android, the system keeps a record that OffPDF may read that one folder. On an iPhone, OffPDF keeps a bookmark — a small piece of data that tells iOS which folder you chose, and nothing from inside it — with the app's other settings on your phone. Neither is ever sent anywhere.
• Taking it back. In OffPDF: Files → On this phone → the ⋯ beside the folder's name → Stop showing this folder. That gives the access back to the system and forgets the folder; nothing in it is deleted, and copies already in OffPDF stay. Removing the app ends it too, and so does clearing its storage on Android. If the folder is moved, renamed or deleted, OffPDF says it can no longer see it and offers to choose it again.
• iCloud. If the folder is in iCloud Drive — where Safari saves downloads unless told otherwise — a file that is only in iCloud is listed from what your phone already knows about it, and nothing is downloaded to list it. When you open such a file, iOS downloads it from your iCloud account first. That download is Apple's, between your phone and your own iCloud; OffPDF sends nothing with it and receives nothing but the file.

When OffPDF uses the network

This is the whole list of requests the app's own code makes. None of them carries a document, a filename, or anything about what you opened.

1. Downloading the AI model, when you ask for it. Private AI is an optional feature and an optional download: 1.2 GB or 2.5 GB for the language model, depending on which one your phone can run, plus 379 MB for the multilingual model that lets it find a passage in one language from a question asked in another. The files come from huggingface.co, from repositories published by Software Mansion, who maintain the AI runtime this app is built on. It is a file download and it carries nothing about you — no account, no identifier, no document. That host sees your IP address, as any website does when you fetch a file from it.

If you never turn on Private AI, none of this happens and nothing else in the app changes.

2. Asking how large those files are. Before a download, and again each time the AI screen or a chat opens, the app asks that same host for the size of each file. It is a header-only request carrying the file's address and nothing else — and, being honest about something that surprised us too, it happens even when the file is already on your phone, because the library that fetches models checks sizes before it checks whether it has already finished. It is a handful of small requests to huggingface.co, not a second download.

The AI runtime can also report a finished download to its own maintainers, with a counter at Hugging Face alongside. OffPDF downloads models in a way that leaves both out, and loads a model only once its files are on the phone, which the runtime does not report. Neither is sent.

3. The store's purchase check, described under Paying for OffPDF.

4. Links you tap. Settings links to offpdf.com and to this page. Tapping one opens your browser, which tells that site your IP address exactly as any link does. Nothing is attached to it.

5. On Android, the first time you scan, described in the next section.

One more download can happen because of something you do in OffPDF, and it is Apple's rather than ours: opening a file in On this phone that is only in iCloud Drive makes iOS fetch it from your iCloud account first, as the Files app would. It is described under One folder of yours.

Google code on Android, and none on iOS

The Android document scanner is Google's ML Kit scanner. It runs on your device — the page is not sent anywhere to be recognised — but the scanner itself is delivered by Google Play services rather than bundled in the app, so the first time you scan, Play services may download it. That request is Google's, it is about the scanner module, and it does not contain your page. If it fails, the app says so and calls it a download, which is the only honest thing to say about a feature that needs the network once.

Text recognition — the part that makes a scan searchable — is bundled instead. The model ships inside the app, so it downloads nothing and sends nothing.

ML Kit also brings Google's own logging component into the Android build (com.google.android.datatransport). It is Google's diagnostics transport, and it may report technical information about Google's components to Google. Its destination is assembled while the app runs and cannot be read out of the shipped binary, so this page describes what is in the build rather than characterising traffic nobody here has watched on the wire. What can be said flatly is this: it does not receive your documents, and OffPDF sends it nothing.

The iOS app contains none of that. The scanner is Apple's VisionKit, text recognition is Apple's Vision framework, and there is no Google code in the iOS build at all.

This is stated plainly because the alternative — declaring "no data collected" on Google Play while shipping that library — would be a misdeclaration, and Play suspends apps for those.

Paying for OffPDF

OffPDF Pro is a one-time purchase, not a subscription. It is one non-consumable product on both stores, and the store handles all of it: the price, the payment, the receipt and any refund.

OffPDF never sees a card number. It never sees your name or your email address. There is no account to create and no OffPDF server for one to live on. Apple or Google knows who bought it; OffPDF does not, and has no way to find out.

When the app needs to know whether you have Pro, it asks the billing client already on your phone one question — does this store account own this product — and gets back yes or no. The only thing kept afterwards is the time of the last yes: one number, so the app does not have to ask again when you are offline. Your receipt and your purchase token are deliberately not kept. There is no server to check them against, so storing them would mean holding your payment record for no benefit at all.

Restoring a purchase asks the store that same question. It needs no email address and no account.

Two more things are kept, and only these two: that the Pro screen has been shown to you once on first launch, and that the one Pro result every install gets for free has been delivered. Each is a single yes-or-no flag in the app's own settings on your phone. On an iPhone the two flags are also written to the Keychain, so that deleting and reinstalling OffPDF on the same phone does not hand out a second free result; they are marked for this device only, they are never sent anywhere, and they contain nothing but the word "true". There is no count of what you used, no record of which tool, no identifier for your phone, and no server that remembers it. Clearing the app's working files does not touch them; removing the app's data does.

What there is none of

• No account, no sign-up, no email address, no password
• No analytics, no crash reporting and no advertising SDK, with one exception, named above and not ours: Google's logging component, which ML Kit brings into the Android build. The iPhone app has none
• No tracking identifier and no advertising identifier, on either platform
• No document ever transmitted, in whole or in part
• No profile of what you open, search for or make. The search index, and everything the AI reads out of a document, are files on your phone
• No over-the-air updates and no remote configuration

Children

The app is not directed at children and collects nothing that would identify anyone of any age.

Contact

support@offpdf.com

Settings → Support opens your mail app with this address filled in. Nothing is sent until you send it, and the app sees nothing of what you write.