Principles
These are working rules, not values on a wall. When a feature conflicts with one of them, the feature changes or doesn’t ship.
Technology should extend what people can do without taking away their say in it.
Software should make the decision easier to make, not make it for you without asking. Automation that acts on your behalf should be visible, reversible and easy to switch off.
Don’t collect sensitive information the product doesn’t need.
The strongest privacy promise is the one the architecture enforces. If a feature can run on your device, it should. Data we never receive cannot leak, be sold or be demanded from us.
There is no server that could receive a document. Editing, OCR and redaction run in the browser tab.
Where practical, you should be able to inspect how a product behaves.
A privacy policy is a promise. A published list of network connections that you can check in your own browser is evidence. We prefer evidence.
Every network connection the app can make is listed, and the security policy is shown live.
Solve the problem first. Add novelty only when it makes the result better.
A feature earns its place by making the work better, not by making a better demo. Sometimes that means leaving the fashionable feature out.
No cloud “chat with your PDF” feature, on purpose: it would mean uploading your document.
Don’t weaken software on purpose to sell the upgrade.
Watermarks, page limits, trial timers and nag screens are friction added deliberately. If something is limited, it should be because of a real constraint, and we should say which one.
No paid tier, no watermark, no page or file size limits. Donating unlocks nothing.
Security, reliability, accessibility and performance come first, not last.
People feel quality even when they cannot name it: the page that loads instantly, the control that works with a keyboard, the file that opens everywhere. That work is the product, not polish on top of it.