What really happens to your file after you click "Upload"

You have a Word document to turn into a PDF, or a JSON file to reshape. You search, you find a free converter, you drag the file onto the page, and seconds later you download the result. It feels instant, contained, harmless — like the file never really went anywhere.

But it did. The word "upload" is doing a lot of quiet work in that sentence. Your file left your computer, travelled across the internet, and landed on a machine owned by someone you have never met. Let's follow it.

The journey of an "uploaded" file

The moment you drop a file onto a server-side converter, this happens:

1. The full contents of your file are copied off your device and sent over the network.
2. They arrive on a third-party server — often behind a CDN, sometimes in another country, sometimes processed by a sub-contractor you were never told about.
3. The conversion runs there, on their hardware, where their logging, their backups, and their staff can reach it.
4. The output is written to disk, handed back to you via a download link — and the original, the result, or both may sit on that server for a while.

"For a while" is the part nobody reads. Most converters promise something like "files are deleted after one hour." That is a promise, not a mechanism. You cannot verify it, you cannot enforce it, and it says nothing about server logs, cached copies on the CDN edge, or the backups that ran in that hour.

What the fine print usually allows

Open the terms of service and privacy policy of a typical free converter and you will commonly find some combination of:

• Temporary storage of your uploaded content "to provide the service" — with the retention window defined by them, not you.
• Sub-processors — hosting providers, CDNs, analytics, sometimes third-party conversion APIs that your file is forwarded to in turn.
• Broad content licenses — language granting the right to "store, process, and reproduce" what you upload. Usually benign in intent; rarely as narrow as you'd assume.
• "We may use data to improve our services" — a phrase that, in 2026, increasingly includes training models.

None of this requires bad actors. It is simply what server-side processing is: your data on infrastructure governed by someone else's policies, logs, and security.

Why it matters even for "boring" files

"It's just a PDF of my meeting notes." Maybe. But documents are rarely as empty as they look:

• A Word file carries metadata: author names, edit history, the company template it came from.
• A contract, invoice, or report contains names, addresses, and figures — personal data under the GDPR/DSGVO the moment a real person is in it.
• A YAML or JSON config routinely contains internal hostnames, API tokens, and credentials.
• Anything touching a client makes you the data processor. Uploading it to a random converter in another jurisdiction can quietly turn a five-second task into a compliance incident.

The uncomfortable test: would you email this file, unencrypted, to a stranger and trust them to delete it? Because functionally, an upload to a free converter is not far off.

There is another way: the file never leaves

Here is the thing most people don't realise — for a huge range of conversions, the server is unnecessary. Modern browsers can do the work themselves. Rendering Markdown to PDF, unzipping a .docx, parsing JSON, YAML, or TOON — all of it can run in JavaScript and WebAssembly, on your own machine, with no network round-trip at all.

This is called client-side (or local-first) conversion. The file is read by the page, processed in memory, and the result is handed back to you as a download. Nothing is uploaded because there is nowhere to upload it to.

How to tell the difference (a 10-second test)

You don't have to take anyone's word for it. Open your browser's developer tools, go to the Network tab, and run the conversion:

• On a server-side tool, you'll see a request fire off carrying your file — often a multi-megabyte POST.
• On a genuinely local tool, converting works even with your network disconnected, and no request carrying your file appears. That is the proof.

How MarkDone is built

MarkDone is local-first by design. Every converter — Markdown to PDF, Word (DOCX) to PDF, JSON, YAML, and TOON — runs entirely in your browser. Your file is read locally, converted locally, and downloaded locally. The only thing that ever leaves the page is an anonymous +1 for the public conversion counter — never your document, never its contents. Turn off your Wi-Fi and the converters still work. That is the whole point.

Want the mechanics of how it works for one tool? Read how to convert Markdown to PDF without uploading your files.