Private PDF tools that forget you were here — merge, split, compress, convert, protect, and watermark documents with no account, no tracking, and files deleted within 30 minutes.
01 / The problem
Most online document tools ask for an account, track how they are used, or leave people wondering where their files went. PDFlow's promise is narrower and harder: accept files from anonymous strangers on the public internet, run third-party parsers over them, hand back a result — and keep nothing.
02 / Key decisions
Decision 01
Inputs are deleted the moment a job ends, success or failure; a sweep every five minutes removes expired results; and an orphan pass deletes anything on disk older than twice the lifetime, whatever the database says — because one deletion path is a single point of failure.
Decision 02
Each file's magic bytes are checked against its extension, size is enforced while the bytes stream in rather than trusted from Content-Length, and the uploaded filename never reaches the disk — files are stored under random UUIDs, with every path verified to stay inside the storage bucket.
Decision 03
Identity is a random job UUID held only in browser memory — a reload genuinely starts over — and rate limits key on IP at both Nginx and the app.
Trade-off
With no accounts, a download link is a bearer capability: anyone holding the job's UUID within its 30 minutes can fetch the result. The mitigation is entropy and a short lifetime, not access control — and the security notes say so plainly.
Decision 04
Workers publish progress to a Redis channel, and whichever API process holds the browser's server-sent-event stream relays it, with the last event cached so a job that finishes before the browser subscribes still reports. Nginx buffering is off on that route — otherwise the browser sees nothing, then everything.
Decision 05
Tasks are acknowledged late and check their own status first, so a job redelivered after a worker dies never redoes finished work; each worker takes one task at a time so CPU-bound jobs don't queue behind a busy one; and soft and hard time limits turn a runaway job into a clear message.
Decision 06
For Protect and Unlock, the document password waits in Redis only until the worker reads it once, then it is deleted — and Redis persistence is switched off in production so it never reaches disk.
03 / Outcome
Thirteen working tools, deployed on Railway as four services — frontend, backend, PostgreSQL, and Redis — with 149 backend tests running in CI.
04 / Inside the product
05 / Technologies
06 / Public resources