The programs behind these tools, FFmpeg, QPDF and others, are compiled to WebAssembly and run inside your browser tab. When you open a file, it stays in the tab's memory. The result is built there too. There is no upload step because there is no server to upload to: the site is static files.
Check it yourself
- Open a tool and wait for the engine to finish downloading. That download is the program itself, not your file.
- Open your browser's developer tools (F12 or Cmd-Option-I) and choose the Network tab.
- Run the tool on a file. No new requests appear. You can also switch your connection off after the engine has loaded; the tool keeps working.
What does leave your device
The page itself, the engine download, and, when ads are present, a request to the ad network for a text ad. That request carries no information about you or your file and sets no cookies. A page-view count is recorded by Cloudflare Web Analytics without cookies or personal data; it knows a page was opened, not who opened it.
Limits
Because the work happens on your machine, the ceiling is your machine: browser memory, and on phones a much lower one. Each tool states its limits on its page.