What actually leaves your device when you upload a PDF to an AI chatbot

The short answer

Uploading a PDF to ChatGPT or any AI assistant sends the entire file to the provider's servers — every page, plus metadata, comments, form values and any text hidden under black boxes. Whether that is safe depends on what the file contains and on the provider's current data policy. The safest habit is to send only the pages or text the question needs.

None of this is specific to one provider. It is how uploading works: the service receives the bytes, and the bytes are the whole document.

What travels inside a PDF

Most people picture the visible pages. A PDF is a container, and an upload sends the container.

• Every page, including the ones you did not need. A question about one clause still sends the other eighty pages of the contract.
• Text under fake redactions. A black rectangle drawn in an editor sits on top of the text; the text is still in the file and any extractor reads it. Models read the extracted text, so they can see exactly what you thought was hidden.
• Metadata. The Info dictionary carries the author's name, the software used and creation and modification dates. Many files also carry an XMP packet with a second, sometimes older, copy of the same details.
• Comments and form values. Review notes, tracked replies and filled-in fields are stored as objects in the file whether or not your viewer is showing them.
• Earlier versions. A file that was edited and saved incrementally can still contain the content as it stood before the edit, appended rather than replaced.
• Attachments. A PDF can embed other files, such as a spreadsheet behind a chart.

What happens to it after upload

That part is a question for the provider, and the honest answer is that it varies by provider, by plan and by account settings, and it changes over time. Questions worth answering from the provider's current policy before you upload anything sensitive: how long uploaded files and conversations are retained, whether they may be used to train models and how to opt out, whether a business or team plan handles data differently from a personal one, and who at the provider can access it.

Separately, check your own obligations. Client confidentiality terms, employment contracts, data protection law and sector rules on health or financial records can forbid sending a document to a third party regardless of what that party promises to do with it. A clear policy from the provider does not grant you permission the document's owner never gave.

Send less: pages and text rather than the whole file

The most effective precaution is also the simplest: do not upload the document, upload the part of it that matters.

Extract Pages copies just the pages you name into a new PDF. The new file is built from those pages alone, so the rest of the document — and the original's metadata dictionary — does not come with it. Links pointing outside the extracted range simply stop working.

Going further, convert the pages to text. PDF to Markdown or Extract Text produce plain text you can read in full before pasting, so you know exactly what the model receives. One warning: text extraction reads every glyph in the file, including text sitting under a drawn-on black box. If anything on those pages was covered rather than removed, extraction will put it straight back into what you paste.

Redact properly, and clean the metadata

If the pages you need contain names, account numbers or anything else the model does not need to see, remove them first and remove them properly.

Redact PDF renders each page to an image, paints the marked areas solid black into the pixels and rebuilds the document from those images, so there is no text left under the marks. The cost is that the rebuilt pages are images, so other text on them is no longer selectable; many AI assistants can still read the page images, but treat that as a separate step to check. Auto-Redact PII finds emails, phone numbers, card numbers and ID-style numbers in the text layer and lists them for approval before applying the same redaction. Its pattern matching misses unusual formats, so review the list rather than trusting it.

For metadata, Edit Metadata shows and rewrites the title, author, subject and keywords, so an Author field holding a colleague's name does not travel with the file. Because redaction rebuilds the document from images, a redacted file starts with none of the original's metadata in the first place.

All of these run in the browser on World of PDF, so preparing the file sends nothing anywhere. The only upload is the one you then choose to make.

A quick checklist before uploading

Run through this before any document with personal, client or commercial information goes into a chatbot.

• Am I allowed to share this document with a third-party service at all?
• Have I read the provider's current retention and training policy, and checked my account settings?
• Can I send a page range, or plain text, instead of the whole file?
• Is anything on those pages covered rather than removed?
• Does the metadata name anyone or anything it should not?

Frequently asked questions