The classic upload model
Your file is copied over the network to a server, written to disk, processed there, and stored again as a result you then download. For a short window, a complete copy of your document exists on hardware you do not control.
Along the way it often passes through a content delivery network, a load balancer and a logging system, each of which can hold fragments. Backups may keep copies longer than the deletion policy suggests.
Why that matters for ordinary documents
Most of what people convert is not secret in a dramatic sense, but it is private: payslips, tenancy agreements, passport scans, medical letters, client work under an agreement that forbids sharing it with third parties.
If you handle other people's data professionally, uploading it to a free converter can quietly breach the agreement you signed, regardless of how trustworthy the service is.
What browser-based processing does differently
Modern browsers can read files, decode images, rewrite PDFs and re-encode audio entirely on your own machine. The tool page is just code that runs locally, so the file is never sent anywhere.
You can verify it: load the tool, disconnect from the internet, and use it. If it still works, nothing is being uploaded. That is a claim you can check rather than a policy you have to trust.
The trade-offs, honestly
Local processing is limited by your device. A very large video on an old phone will be slow, and a few specialised jobs genuinely need heavy server hardware.
For everything else — documents, images, text, encoding, generating — the browser is now fast enough that the upload round trip is pure cost with no benefit.