Clean Sheet PDF reads, redacts, merges and fills in PDFs, and lets you sign them. It is built to collect nothing about you — no account, no sign-up, no tracking, no ads, and no analytics.
Nothing. There is no account to create and no email to enter. There are no analytics, advertising or tracking SDKs in the app, and no third-party software of any kind — the app uses only Apple's own frameworks.
This matters more here than in most apps, because the files you open are contracts, medical letters and bank statements. The compiled app contains no networking code: no URLSession, no WKWebView, no CFNetwork, nothing that could open a connection. A script checks the source for those symbols before every release and fails the build if one appears. Put the device in Airplane Mode and every feature works exactly the same.
This is also why the app does not convert PDFs to Word or Excel. Doing that accurately needs a server, and sending your document to a server is the one thing this app will not do.
In the app's own folder on your device. On iPhone and iPad that folder is visible to you in the Files app, so you can take documents out or delete them without this app's help. On a Mac the app is sandboxed and the folder sits inside the app's own container, so the way to put a copy somewhere else is the app's Share command. Deleting a document removes it; deleting the app removes all of them. Nothing is copied anywhere else, and nothing is synced.
Form answers are part of the document, not something the app keeps separately. They are held in the PDF you are working on and written into the copy you save. If you leave Lock the answers switched on, the page is rebuilt with your answers drawn into it, which means they can no longer be edited by whoever receives the file — and no longer read back out of it as form data either. Nothing about them is recorded anywhere else in the app.
If you draw a signature and leave Remember this signature on this device switched on, the app stores it in its own storage on that device so you do not have to redraw it every time. It is never transmitted — there is no networking in the app to transmit it with — and it is never shared with us or anyone else.
Two things worth knowing, stated plainly:
To be clear about what a signature here is: it is a handwritten signature, the same thing you would produce with a pen on paper. It is not a cryptographic digital signature, and it carries no certificate or key.
If you use the share sheet to send a PDF somewhere — email, Messages, another app — that transfer is made by your device at your request, and whatever you send it to has its own privacy policy. The app itself never initiates a transfer.
These three go through the same engine, and it works the same way each time. When you redact an area, the page is rebuilt as an image with that area painted out, and the new page is written without the original text. The words are not covered up; they are absent from the new file. Locking your answers and signing a page rebuild it the same way, so what you added becomes part of the page rather than a layer sitting on top of it that someone can edit, delete or lift off.
The app re-reads its own output before saving and refuses to hand you a document it cannot verify came out as promised. Your original file is never modified — redacting, filling in and signing always save a copy.
The app collects no data from anyone, of any age.
If this policy ever changes, the updated version will appear on this page.
Questions: john@johnvdoan.com
Last updated 16 September 2026.