A PDF is a container. Next to the pages you read, it can hold whole files, scripts that run when it opens, the text of earlier saves, layers that are switched off and the values typed into a form.
The tool runs in your browser (JavaScript required). Nothing is uploaded.
Some of it is put there on purpose — an attached spreadsheet, a form that adds up numbers. Some of it accumulates: every time a PDF is saved incrementally, the previous version stays inside the file, and text deleted in the last round can be read from it.
Everything found is shown before anything is changed, with what it is and where it sits, so you can tell an attachment you meant to send from one you forgot about. Items this version cannot look inside — the contents of an attachment, for example — are said to be unread rather than passed as checked.
The copy is then written from scratch, which is what makes earlier saves disappear, and is reopened and scanned again before anything is reported as removed.
No. Attachments are listed with their name, size and type, and removed if you choose; what is inside them is not inspected, and the report says so.
For ordinary reading, no: scripts are not needed to display a page. A form that calculates totals will stop calculating, which is why scripts and form fields are separate decisions.
Because saving a PDF often appends changes instead of rewriting it, so the previous state is still inside. The copy made here is written in one piece, without them.
Yes — white text, text with no fill and text under a picture are read like any other text. Whether you remove it is still your decision.
It is refused with an explanation instead of being unpacked. A PDF that expands far beyond its size is a known way to exhaust a browser, so it is stopped before that — and nothing is reported as checked.