What "runs in your browser" actually means

A tool that processes documents in your browser rather than on a server makes a genuine promise: the file is not uploaded. For a contract, a medical record or an internal document, that is often the difference between being able to use a tool and not.

It is worth being precise about the boundaries of that promise, because "private" is doing a lot of work in most descriptions and covering less than it implies.

What it does guarantee

The document does not leave the machine. It is read by the browser from your disk, held in memory, processed, and written back out as a download. No copy exists on anyone's server, so there is no retention policy to trust, no breach that can expose it, and no jurisdiction question about where it was processed.

This is the whole benefit, and it is a substantial one. Most document tools work the other way, and their privacy policy is a promise about what they do with your file after receiving it.

What it does not guarantee

Your browser is not a vault. Anything running on your machine with access to the page — an extension with broad permissions, for instance — is inside the boundary. Local processing protects against the remote party, not the local one.

Downloads land on disk. The output goes to your downloads folder like anything else, subject to whatever backup or sync runs there. A redacted document synced to a cloud drive has left the machine, just not via the tool.

Local storage is still storage. Features that remember your work — a project you can return to, a document carried between tools — write to the browser's storage. That is on your device, not a server, but it is not nothing, and it should be visible and clearable.

The page itself is served from somewhere. The code arrives over the network like any web page. Local processing means your *document* is not transmitted; it does not mean nothing is.

Questions worth asking of any such tool

• Does it say what it stores locally, and give you a way to clear it?
• Does the privacy claim cover every feature, or just the main one? A tool that processes locally but sends filenames for analytics has a narrower promise than it appears.
• Can you verify it? Local processing is observable — a browser's network panel shows whether a file was uploaded — which is more than can be said for a policy.

The cost, stated plainly

Local processing is slower. Recognition on a long scan takes minutes because your machine is doing work a server farm would do faster. Large documents use memory your browser has to find.

That is the trade: speed for the file never leaving. For a holiday photo it is a poor trade. For a document you would not email to a stranger, it is usually the right one — and the sensible approach is to know which kind of document you are holding rather than applying one rule to both.