Published July 21, 2026 · 10 min read
iLovePDF is the most-visited online PDF tool in the world — over 100 million monthly visits. Its interface is clean, its feature set is broad, and its free tier is generous. But there is a question that privacy-conscious users keep asking on Reddit, Hacker News, and security forums: "Does iLovePDF actually upload my file?"
We tested it. The answer is yes — every file you process with iLovePDF is transmitted to their servers. This article documents the test, explains what their privacy policy says, and helps you decide whether that matters for your documents.
The test: what happens when you merge a PDF on iLovePDF
We opened iLovePDF's merge tool in Chrome, opened Developer Tools (F12), switched to the Network tab, and merged two small PDF files. Here is what the Network tab showed:
- 1Page load: HTML, CSS, JavaScript assets loaded from ilovepdf.com and CDN.
- 2File selection: when we selected two PDF files (combined 2.4 MB), the browser initiated a POST request to https://api.ilovepdf.com/v1/upload.
- 3Upload: the full file data (2.4 MB) was transmitted to iLovePDF's server. The request payload contained the raw PDF bytes.
- 4Processing: a subsequent request triggered server-side merging.
- 5Download: the merged PDF was downloaded from their server back to our browser.
Total upload: 2.4 MB of file data sent to iLovePDF's servers. Total download: 2.3 MB merged file received back. The entire operation depended on a network round-trip.
What iLovePDF's privacy policy says
To be fair, iLovePDF is transparent about this. Their privacy policy and help documentation state:
- Files are uploaded to their servers for processing.
- Files are stored on European servers (they are a Spanish company).
- Files are "deleted within 24 hours" of processing.
- They do not claim to read or analyze file content.
- GDPR applies to their processing (EU data protection law).
This is a reasonable policy for a server-based tool. But "we delete it within 24 hours" is fundamentally different from "we never receive it." The distinction matters for three audiences.
Who should care about the upload?
1. Lawyers handling privileged documents
Uploading a document covered by attorney-client privilege to a third-party server may constitute a disclosure that weakens or waives the privilege. iLovePDF is not your client, your co-counsel, or your expert — it is a Spanish technology company. Even if they delete the file in 24 hours, the transmission itself is the disclosure event. See our guide to PDF tools for lawyers for the full analysis.
2. Healthcare workers handling PHI
If a PDF contains Protected Health Information (patient names, diagnoses, medical record numbers), uploading it to iLovePDF creates a HIPAA disclosure without a Business Associate Agreement. iLovePDF does not offer BAAs for free users. See our HIPAA-safe PDF tools guide.
3. Anyone under NDA or data protection obligations
Employment contracts, vendor agreements, and GDPR data processing agreements often prohibit sharing documents with unauthorized third parties. A PDF tool vendor is a third party. The 24-hour deletion promise does not undo the transmission.
The alternative: what "no upload" actually looks like
We ran the same merge test on LoveMyFile's merge tool. Here is what the Network tab showed:
- 1Page load: HTML, CSS, JavaScript assets loaded from lovemyfile.com.
- 2File selection: the browser read the files from disk into JavaScript memory. No network request.
- 3Processing: pdf-lib merged the files in browser memory. No network request.
- 4Download: the merged PDF was generated from memory and offered as a download. No network request.
Total upload: 0 bytes. Total file-data network requests: zero. The file never left the device. You can verify this yourself on any tool page — open F12, switch to Network, and process a file.
Side-by-side comparison
| Aspect | iLovePDF | LoveMyFile |
|---|---|---|
| File uploaded to server | Yes (every file) | Never |
| Server location | Europe (Spain) | N/A — no server |
| Retention period | Up to 24 hours | Zero (in-memory only) |
| BAA available | No (free tier) | Not needed |
| Works offline | No | Yes |
| Account required | Optional | No |
| Daily limit (free) | None with account | None |
| PDF-to-Word conversion | Yes | No (requires server) |
| Verification method | Trust their policy | Check Network tab |
iLovePDF information based on their published documentation and our Network-tab test as of July 2026. We are honest about where they are better: PDF-to-Word conversion requires server-side rendering and cannot be done in a browser.
Is iLovePDF "unsafe"?
No. iLovePDF is a legitimate, well-run company that complies with GDPR and deletes files promptly. For non-confidential documents — a restaurant menu, a travel itinerary, a homework assignment — uploading is a perfectly reasonable trade-off for convenience.
The question is not "is iLovePDF evil?" The question is: "does this specific document deserve a tool that never receives it?" If the answer is yes — if the file contains privileged, regulated, or confidential information — then a client-side tool is the architecturally correct choice. Not because the alternative is malicious, but because the risk is unnecessary.
Try it yourself
Open LoveMyFile's Merge PDF, press F12, switch to the Network tab, and merge two files. Then do the same on iLovePDF. Compare the Network tab. The difference is not a marketing claim — it is an observable, verifiable architectural fact.