A quiet Network panel is not a privacy certificate. Check a specific tool, file and browser session, separate document processing from ordinary site requests, and record what you could actually observe. Start with a synthetic file—not a confidential document you are trying to protect.
Run one controlled PDF preview test
These instructions use desktop Chrome terminology. Other browsers expose similar controls with different names. First download the five-page synthetic PDF. That download is an intentional request for a public sample, not an upload of a selected document. The sample contains the title “Example project notes” and the author “Example author”.
- Open a fresh browser profile or guest window without optional extensions. Record the browser version, tool URL, date and whether any consent dialog or ad blocker is present.
- Open PDF Preview, then Developer Tools → Network. Keep recording enabled, choose All request types, enable Preserve log and Disable cache, and reload. Save or inspect this initial-load baseline before clearing it.
- In Application → Service workers, note whether the page has a controlling service worker. For a network-forced comparison, enable Bypass for network and reload. This is a separate test condition, not normal cached operation.
- Return to Network, clear the list and select your downloaded sample. Click Validate and preview. Wait for the result and inspect the whole request list, including requests after the result appears.
- Check for five pages, the expected title and author, and a first-page image with thumbnails. Preview has no generated-file download; its result is an on-page inspection.
- For any unexpected request, inspect Headers, the full URL and query parameters, Payload where available, and Initiator. Check WebSocket messages if such a connection appears. Do not inspect only Fetch/XHR or only POST requests.
- Remove the sample, reload and repeat once with normal cache and service-worker settings restored. Record which setting changed and which requests disappeared or returned.
Chrome documents the recording and inspection controls in its Network reference. Its service-worker guide explains that bypassing the worker changes the request path. Disable cache alone does not establish that every response came from the network.
Classify requests before drawing a conclusion
| Observation | Interpretation and next check |
|---|---|
| JavaScript, fonts, PDF worker or WASM downloads | The browser may be fetching processing code or public dependencies. Check the destination and payload; download size alone does not show that your file was sent. |
A blob: preview address | The app created a browser-local reference to generated image data. That address is not an HTTP upload, but its presence does not rule out a separate network request. |
| Google or Cloudflare requests | Ads and analytics can be enabled by deployment configuration. Inspect their requests too; the fact that a service is expected is not proof that its payload is harmless. |
| No POST, PUT or PATCH | Useful but incomplete: data can also appear in a GET URL, another request type or a connection’s messages. Inspect all visible destinations and parameters. |
| A blocked or failed request | Record it as an attempted request. Failure in your environment does not demonstrate that the app would make no connection elsewhere. |
You can rename a copy of the sample with a harmless unique marker and search visible request details for that name. Finding it is a reason to investigate. Not finding it proves much less: binary, compressed, encoded or transformed data may not contain searchable text. Even a same-origin request deserves inspection; “our domain” does not mean “stayed in memory”.
Check what persists after the workflow
In Application, inspect Local Storage, Session Storage, IndexedDB, Cookies and Cache Storage for this origin before and after the operation. Refresh each view where necessary. The Application panel guide describes these stores. They are different from the files in your Downloads folder and from the browser’s ordinary HTTP cache.
toolnest:favourites:v1andtoolnest:recent:v1contain saved tool paths. Opening a tool may add its route; this does not mean the PDF itself was saved there.pdfforfree.gst-seller.v1is written when you explicitly save a supplier profile in GST Invoice, Quotation or Proforma. It can contain the name, address, phone, email, GSTIN, state code and registration setting.pdfforfree.po-buyer.v1stores those buyer-profile fields when you explicitly save them in Purchase Order. A saved profile is not a saved invoice, order, logo or signature.- The generated service worker caches same-origin GET responses, including public pages and processing assets. Inspect the cache entries rather than assuming an empty Network list means an unused engine.
To test profile persistence safely, use the fictional supplier from the manual-entry invoice example, select Save profile, reload, and inspect the matching key and Load saved control. Then use Clear saved. Do this in the isolated test profile so you do not overwrite a supplier you wanted to keep.
Clearing this site’s data removes preferences, saved profiles and offline assets; export anything you need first. It does not delete downloaded PDFs, operating-system backups or copies already shared elsewhere. Closing a tab releases the app’s active workflow, not a forensic guarantee that every device-level copy has been erased.
What the existing evidence actually covers
The synthetic preview was checked on 7 September 2026 in the following Linux browser runs. Their recorded checks cover page count, decoded images, metadata and the absence of a preview export link—not a comprehensive network or storage audit.
- Chromium 151.0.7922.34: five-page sample preview and editing check completed.
- Firefox 153.0: five-page sample preview and editing check completed.
The downloadable Chromium observation record was created by the verifier, not exported by PDF Preview. It is not a HAR file, screenshot or certificate. The batch verifier rejected page-observed HTTP methods other than GET and HEAD, with service workers blocked. It did not preserve a complete request-body inventory or establish coverage of all worker and third-party traffic.
Source inspection explains the intended path: pdf-preview-runtime.ts
reads the selected file into bytes and passes them to PDF.js; PDF worker,
font and WASM asset paths are self-hosted. pdf-engine-runtime.ts
transfers bytes to the editing-check worker. PdfPreviewTool.tsx
creates and revokes preview Blob URLs when clearing results. A worker is a
processing context, not a network firewall.
Separately, public-site-config.ts and monetization.js
gate the AdSense and Cloudflare Analytics loaders using deployment settings.
Source review is not confirmation of what is configured on today’s live
deployment. Review the source repository,
compare the deployed version, and repeat the browser check when the build or
settings change.
Offline checks and honest conclusions
After one successful online sample run, try the same workflow offline with the service worker enabled and cache bypass off. Success supports a limited conclusion: those already-available assets could process that sample without a working connection. Failure may mean an engine or page was not cached. Neither result proves what happens before disconnection or after reconnection; keep observing when you restore the network.
Record the tool, browser version, sample, cache state, consent state and observed destinations. Prefer “no unexpected transmission was observed in this run” to “the website can never upload anything”. DevTools cannot certify browser extensions, the operating system, compromised code or every future deployment. Hosting providers still receive ordinary page-request data.
If sharing a HAR for help, inspect it first even when exported as sanitized: URLs and payloads can still reveal information. Share a synthetic reproduction and the suspicious destination through Contact, not the confidential original. Do not upload private files to an online “privacy checker” to test this site.
Primary sources
- Chrome DevTools: Network features reference Chrome for Developers. Network recording, request details, cache controls and HAR export. Consulted 7 September 2026.
- Chrome DevTools: Application panel Chrome for Developers. Inspecting local storage, cookies, IndexedDB and Cache Storage. Consulted 7 September 2026.
- Service-worker development controls Chrome for Developers. What Bypass for network changes, and why it is not the same as normal service-worker operation. Consulted 7 September 2026.