Your papers, your business.

Pipit is a local-first PDF reader. There is no account system, document-processing backend, or analytics script in this alpha.

What stays on your device

PDF rendering, text extraction, Rust/WebAssembly reference lookup, notebook entries, bookmarks, preferences, and reading history happen in your browser. Recent documents use local IndexedDB storage; reading state and notes use browser-local storage. Clearing browser data or uninstalling an extension can remove this data. Export important notes.

What still uses the network

This download page is hosted by Cloudflare, which necessarily receives ordinary connection information such as IP address and requested URL. We do not add application analytics or fingerprinting. Browser/platform detection runs locally to suggest a package; detection results are not sent to a separate service.

Opening a remote PDF contacts its source website and may use normal browser caching. Explicit DOI, arXiv, or Scholar actions contact those external services. The web reader’s URL opener needs a source that permits cross-origin requests; choosing a local file does not upload it.

Why the extension requests website access

Host permissions let Chromium and Firefox open top-level PDF responses and fetch the document you requested. Safari uses explicit toolbar/link opening. There is no content script reading arbitrary webpage text. You can restrict website access using your browser’s extension settings, at the cost of PDF opening on those hosts.

Alpha boundaries

Local storage is not an encrypted vault. Do not assume protection against someone with access to your browser profile. This release has not undergone an independent security audit. Review sensitive documents according to your institution’s policies.