The short version: your documents never leave your machine, because nothing in the app can send them anywhere.
Every PDF you open is read, rendered and edited on your own device. The desktop app has no HTTP client in the binary — not disabled, not opt-out, absent. The browser version does the same work in the page itself; there is no server to upload to, and none exists. You can check both claims: the source is public.
Nothing about a document is collected, logged or transmitted. Not its contents, not its name, not the fact that you opened one. There is no analytics, no telemetry and no crash reporting.
An OpenApps account, which is optional and only needed for the two Supporter tools (watermark and OCR). If you sign in, an account service at auth.openpdfedit.com handles it, and it sees what any sign-in service must: the identity you sign in with, your credit balance, and the fact that you unlocked something. It never sees a document — the app has no way to send it one.
Signing in is the only network request the app makes on your behalf. Never signing in means it makes none at all.
Recognising text in a scan happens on your device too. In the browser, the recogniser and its language data are downloaded once from this site — not from a third-party CDN, which is what the underlying library would do by default — and then cached, so it works offline afterwards. The page being recognised is never sent anywhere.
No cookies, no analytics, no third-party scripts, no embedded fonts from anyone else’s server. The web app stores one thing in your browser: your sign-in session, if you have one, which signing out removes.
Downloads are served by GitHub, which will see your IP address the way any file host does.
Open an issue on GitHub. If something here turns out to be inaccurate, that is a bug and worth reporting as one.