Our approach
OCR.now processes uploaded files to return recognition output. The current application uses temporary working directories for OCR and does not require an account, but an online upload should never be treated as appropriate for every document.
Before uploading a document, use the online OCR privacy checklist, then review the technical boundaries in our security overview.
Files submitted for recognition
The application validates the submitted format, writes the upload into a request-specific temporary directory, renders PDF pages there when necessary, and removes that directory when processing finishes. Raw upload paths are not published as site URLs. A browser preview uses a local object URL for the active page session.
Files submitted for recognition checks
- Maximum request size is 20 MB.
- PDF processing is limited to the first 25 pages per request.
- The current accepted formats are PDF, JPG, JPEG, PNG, WebP, BMP, and TIFF.
- OCR output can contain sensitive text even when the source image is no longer present.
Data minimization before upload
Only submit a file you are authorized to process. Crop unrelated pages and remove fields that are not needed for the task. A visual rectangle is not a safe redaction if the underlying pixels or text can still be recovered. High-risk identity, health, financial, legal, employment, child, credential, and confidential business documents may require an approved offline workflow.
Data minimization before upload checks
- Confirm that redactions permanently remove source information.
- Avoid uploading a full document when one non-sensitive region is sufficient.
- Close notifications and unrelated windows before taking a screenshot.
- Verify organizational, contractual, and legal requirements before using an online service.
Operational records and third parties
This repository does not add advertising trackers, analytics scripts, account profiles, or marketing forms to the rendered pages. A production web server and hosting provider can still process ordinary network records such as an IP address, request time, requested path, response status, and user agent for delivery, security, and troubleshooting. The operator must keep the public notice aligned with the actual hosting, logging, backup, and support configuration.
Operational records and third parties checks
- Do not infer that temporary application files eliminate all infrastructure logs.
- Do not put document content in a URL or search query.
- Production retention, access, deletion, and legal-request procedures require operator review.
- This page must be updated if analytics, advertising, accounts, storage, or new processors are introduced.