This one needs an upload, and is deleted afterwards
Browsers cannot do this calculation, so the file goes to our server. It is deleted automatically 60 minutes after the job finishes, and the working copy lives in a memory filesystem that is wiped whenever the server restarts.
We do not log file names and do not log file contents — that is a hard rule in our engineering standards, not a setting.
What it does — and what it doesn't
http, https and mailto only. `javascript:` is always refused — PDFs can embed JavaScript, and that is a real attack surface, not a theoretical one.
The visible marker is drawn into the page content, because most readers do not draw annotation borders — without it nobody knows the area is clickable.
Some readers, especially on phones, are generous about the clickable area, so a very small box catches neighbouring taps.
Links are not detected automatically — URL text in the document does not become clickable by itself.
Common questions
Can it link to another page in the document?
Currently only external addresses and email. Use PDF bookmarks for in-document navigation.
Why no automatic detection?
Automatic detection turns things into links that should not be, such as domain names inside citations. Drawing them is more accurate.
Will antivirus software block them?
Not links to ordinary websites. That is part of why only those three schemes are allowed.
