Home › Blog › Privacy

Privacy

Your OCR tool probably uploaded that payslip to a stranger

By Sourav Mahapatra · 26 July 2026 · 6 min read

You have a screenshot of a bill, a scanned Aadhaar, a photographed page of a contract. You need the text out of it. So you search "image to text", click the first result, and drop the file in.

That file just left your computer. It travelled to a server you have never heard of, owned by a company you did not check, in a country you did not choose.

What actually happens to an uploaded document

It varies wildly, and that is the problem. Some OCR services delete files the moment processing finishes. Others keep them for a "short predefined period" that is never quite defined. And tools that make you create an account before you can convert anything are almost always storing your files, because an account is how they attach the file to you.

When you upload, you are trusting an unknown third party with whatever is in that document. For a meme, fine. For these, less fine:

• Government IDs. PAN, Aadhaar, passport, driving licence. The exact set of numbers used to impersonate you.
• Payslips and bank statements. Salary, account numbers, employer, address.
• Medical reports. Health data you would not hand to a marketing company.
• Signed contracts. Client names, commercial terms, signatures.

The safest upload is the one that never happens.

There is a second way to do OCR

Browsers got good. Optical character recognition now runs perfectly well inside the browser tab using WebAssembly, on your own processor, with no network round trip. The image is read where it already sits. Nothing is transmitted, so nothing can be retained, leaked, or subpoenaed.

You can verify this yourself in about ten seconds, which is the part most privacy claims cannot survive. Open your browser developer tools, switch to the Network tab, then run the conversion. If the tool is honest, that panel stays empty. No request, no upload.

How to get clean text out of a bad scan

OCR quality is mostly an input problem. A few things help more than any tool choice:

• Shoot flat and square. A page photographed at an angle loses accuracy fast. Get the camera parallel to the paper.
• Light it evenly. A shadow across the middle of a page reads as a smudge. Daylight near a window beats a ceiling bulb directly overhead.
• Do not shrink it first. Compress after you have the text, never before. Detail you delete is detail the reader cannot use.
• Crop to the text block. Fewer logos, stamps and borders means fewer stray characters to clean up.

Then redact before you forward it

Pulling text out is usually step one. Step two is sending it to an accountant, a colleague, or a form. That is the moment to strip the parts nobody downstream needs, especially now that India's data protection rules put real obligations on anyone handling personal data. Our PII redactor does that in the browser too, and this piece explains what to remove and why.

The short version

Uploading a document to read it is a habit, not a requirement. The processing can happen on your machine, and when it does, the privacy question disappears entirely rather than being answered by a policy page you did not read. Pick tools that never ask for the file in the first place: image to text, and check the Network tab if you want proof.

Questions people actually ask

Is online OCR safe to use?

It depends entirely on whether the file is uploaded. Server-based OCR sends your document to a third party, and retention policies vary from immediate deletion to indefinite storage. OCR that runs inside your browser never transmits the file at all, which removes the question.

How can I check whether a tool uploads my file?

Open your browser developer tools, select the Network tab, then run the conversion. If no request appears, the file stayed on your device. This is a direct check that does not rely on trusting a privacy policy.

Can browser-based OCR handle handwriting?

Printed text is far more reliable than handwriting. Clear block capitals sometimes work, but cursive and rushed handwriting remain difficult for OCR generally, not just in the browser.

Does OCR work offline?

Once a client-side tool has loaded in your browser, the recognition itself needs no connection because the processing happens locally on your own processor.

What file types can I convert to text?

Common image formats such as JPG, PNG and WebP, plus screenshots and photographs of documents. For a multi-page PDF, extract the text with a PDF tool instead of running OCR on each page image.

Written by Sourav Mahapatra, who builds BeginThings: free browser tools and BeginRooms, a 3D workspace you can walk through. Take the 30-second tour or start a free 15-day trial, no card needed.