VERIFY NO UPLOAD

Check that your file never leaves your device

LensUp’s free tools work on your file inside your browser tab. You don’t have to take our word for it. On 17 October 2026 we ran 14 of them on made-up files and recorded the requests each page made: we found the file, the result and the file’s name in none of them. Below is what we found, what the page does send and to whom, and how four other tools compare.

What we found

In every tool we chose a made-up file — a specimen contract as a photo, a PDF, a Word file and an e-book, a drawn ID card, a generated portrait; each says SPECIMEN — ran the tool to the end and downloaded the result. After the file was chosen, the page fetched its own code, workers and models from lensup.ai, sent lensup.ai nothing but LensUp’s own step labels (42 in all, each naming a step and the tool, the largest 61 bytes), and sent Google Analytics its usage events. The largest request body any tool sent to another site was 378 bytes; the test files were 1.3 KB to 621.2 KB.

Every row: lensup-tools.csv. One run per tool in Chrome, on 17 October 2026; what the test does not cover is listed at the end.

What the page sends, and to whom

• lensup.ai — the page, the tool’s code, and the models and data some tools need: to read text, to find a page’s corners, to check a passport photo. They come down to your browser; nothing of your file goes back.
• lensup.ai, LensUp’s own step counts — when analytics is allowed, a short label once a day for each step you reach: opening the site, choosing a file, pressing the tool’s button, being asked to sign in, seeing a Pro offer, getting the result. The label names the step and the tool (for the first page, the kind of page and the site that linked to it, or the campaign name in the link), with a random visitor ID from a lensup.ai cookie. Never the file, its content or its name. In our test each page sent its visit as it opened (home:utm-b1_check, tool:utm-b1_check), and after the file input_ready, generate_click, result_ready with the tool’s name, each a body like {"type":"input_ready","detail":"scan-to-pdf"}. Details are in the Privacy Policy.
• Cloudflare, which serves lensup.ai — page-load timings and a check against bots, on lensup.ai’s own address (/cdn-cgi/), before you choose a file.
• Google Analytics — that a tool was used, and how: which tool, which page, the page language, the kind of file (image, PDF…), the file format, how many files, the effect chosen, the quality setting, the page layout, roughly how long the work took, the format saved, as short labels such as convert-image-to-jpg, docx, jpg, 1-3s. Like every Google Analytics hit, each also carries the visit: the page’s address and title, a random visitor and session ID, the screen size and the browser. Never the file, its content or its name; in our test the largest request body was 378 bytes.
• Google AdSense — the ads, requested with the page before you choose a file, with the page’s address and the screen and browser details that ad requests carry.

The analytics and ad scripts run in the same page as the tool. A test like ours shows what they send, not what they could read — which is why the free tools keep your file in the page’s memory and never send it anywhere, and why we check. What each service collects, and how to turn analytics off, is in the Privacy Policy.

How four other tools compare

On 12 October 2026 we ran the same test once on each of four online tools people use for the same jobs: the free version, no account.

iLovePDF, Smallpdf and CamScanner convert files on their servers, so the file has to be sent there; what happens to it afterwards is up to their own policies, which this test does not check. CamScanner sent the file as soon as it was chosen, and then could not convert it. Scanned Maker, like LensUp, made its result in the browser. Every row: other-tools.csv.

What this test does not cover

• One run per tool, in Chrome: on 17 October 2026 from Taiwan for LensUp, on 12 October 2026 from Hong Kong for the other tools. Safari, Firefox and phones were not run, and neither was the cookie banner shown in the EEA and the UK.
• We ran the same 14 LensUp tools as when we first published this page. Tools added since — merging, splitting, rotating and organising PDFs, PDF to JPG, compressing Word and PowerPoint files, and others — were not run.
• Analytics was allowed: the most a LensUp page sends — Google Analytics, AdSense and LensUp’s own step labels. We opened every page with utm_source=b1_check in its address, so the test’s visit labels name that campaign. What lensup.ai does with a label once it arrives is not something a browser can see; the Privacy Policy says what it keeps.
• During the test, requests to Google’s ad and analytics servers were recorded and then stopped, so the test sent no fake visits or ad views. Whatever their replies would have set off is not in it.
• In every tool, one request went past our recorder — Cloudflare’s bot check fetching its script from lensup.ai: https://lensup.ai/cdn-cgi/challenge-platform/h/b/scripts/jsd/d2d3316b729e/main.js. The browser logged the address, which does not hold the file’s name, but the recorder could not read or stop anything else it carried.
• The search finds the file, the result and the file’s name sent as they are or base64-encoded; something compressed, re-encoded or summarised on its way out would not match. So we also read what was sent: after a file was chosen, the only requests to lensup.ai with a body were the 42 step labels, each exactly a step name and a tool name from LensUp’s fixed lists, with nothing else in it, and every request to another site was a Google Analytics hit holding the event labels and visit details above (62 hits, the largest body 378 bytes).
• A feature that needs our server is never one of the free tools, and it says so before you use it: it shows a cloud-processing notice and sends only the pages you choose, after you confirm. Today that is LensUp Pro’s high-accuracy text recognition, not on sale now — not part of this test. The feedback form sends what you type, the page you sent it from and its language, and the server notes your browser and its main version — never a file.

If you see one of our tools send something this page does not describe, please tell us; we will look into it and update this page.