What gets scanned when you use a document editor

Different document editors check different things about your files and how you use them. Some scan the content inside your documents — the words, numbers, and images. Others track what you do with the editor itself — when you open it, how long you work, which features you use. Some do both. Some do neither, or only check things that help the program run without sending data anywhere.

The things that get checked fall into a few categories: content scanning (reading inside your files), activity tracking (watching how you use the editor), device information (learning about your computer), and account data (storing information tied to your login). Understanding which category matters to you helps you pick an editor that matches your comfort level.

Key Takeaways

  • Content scanning means the editor reads inside your documents to check for viruses, improve features, or train AI — and this data may be stored or shared.
  • Activity tracking records when you open files, how long you work, which tools you use, and sometimes what you type, sent to the company's servers.
  • Device information includes your operating system, browser type, IP address, and hardware details, collected to understand how the editor performs.
  • Local-only editors check nothing beyond what is needed to run on your computer, but offer fewer features and no cloud backup.
  • What gets checked is usually in the privacy policy, but the policy often uses vague language like "improve our services" that does not say exactly what happens to your data.

Content scanning: what happens inside your documents

When you open a document in Microsoft Word, Google Docs, or similar editors, the program can read the text, images, and formatting inside the file. This happens for several reasons. The editor may scan for viruses or malware embedded in the document. It may analyze your writing to offer grammar suggestions, spell-check, or style improvements. It may extract information to train artificial intelligence features like auto-complete or summarization.

What matters for your privacy is what happens to that content after it is scanned. Some editors process it only on your device — the scan happens locally, and the content never leaves your computer. Others send samples or summaries to company servers. Google Docs, for example, sends your document content to Google's servers so you can access it from any device, and Google also uses some of that content to improve its AI features. Microsoft Word does similar scanning when you use cloud-connected features like Editor suggestions.

If your documents contain sensitive information — medical records, financial data, legal drafts, or anything you would not want a company to see — content scanning is the category that matters most. Local-only editors like LibreOffice or Notepad do not scan content at all because they have no connection to company servers. Cloud editors like Notion or Dropbox Paper scan everything because the content must be sent to their servers to sync across your devices.

Activity tracking: monitoring how you work

Activity tracking records what you do inside the editor, separate from what is in your documents. This includes when you open the program, how long you work in a session, which features you use (spell-check, find-and-replace, templates), whether you share documents, and sometimes keystroke patterns or typing speed. Some editors also track which menu items you click or which buttons you hover over.

Companies collect this data to understand how people use their product, find bugs, and decide which features to build next. Google Docs tracks which formatting options users click most often. Microsoft Word records whether people use the Outline view or the Editor pane. Slack's document editor tracks how often people use the search function. This data is usually sent to company servers in real time or at intervals throughout your session.

Activity tracking is less sensitive than content scanning because it does not reveal what you are writing — only that you are writing. However, it can still reveal patterns about your work: whether you work late at night, how often you edit the same document, or whether you use collaboration features. If you want to minimize what the company knows about your habits, local-only editors again offer the most privacy because they send no activity data anywhere.

Device and system information collected automatically

Nearly every document editor collects information about your device and network. This includes your operating system (Windows, macOS, Linux), the version of the editor you are running, your browser type if you use a web version, your IP address, and sometimes your device type (laptop, tablet, phone). Some editors also collect information about your screen resolution, installed fonts, or available disk space.

This data helps the company understand whether the editor works well on different systems and diagnose problems when users report crashes or slow performance. It is also used for analytics — companies want to know how many people use Windows versus Mac, or whether the mobile version is popular. The data is usually sent when you first open the editor and then periodically during use.

Device information is generally considered lower-risk than content or activity data because it does not reveal anything about you personally or what you are doing. However, your IP address can be used to estimate your location, and combined with other data it can help identify you. If you use a VPN or proxy, this data is less revealing because the IP address points to the VPN service, not your actual location.

Account and login data tied to your identity

If you create an account to use a document editor, the company stores information tied to your login. This includes your email address, password (usually encrypted), your name if you provided it, your profile picture, and sometimes your phone number or payment information. The company also stores a record of when you created the account, when you last logged in, and which devices you have logged in from.

This data is necessary for the editor to work — it needs to know who you are so it can show you your documents and sync them across devices. However, it also means the company has a permanent record of your identity and your usage patterns. If you delete your account, some of this data may be kept for legal or security reasons, usually for a set period like 30 or 90 days.

Account data is the most personally identifying information an editor collects. If you want to avoid this, you can use editors that do not require an account — local-only editors like LibreOffice, Notepad, or Vim do not ask for any login. However, you lose the ability to sync documents across devices or access them from anywhere.

How to find what a specific editor checks

The official place to learn what an editor checks is its privacy policy, usually linked at the bottom of the website or in the settings menu. Privacy policies are required by law in most places, but they are often written in legal language and use vague phrases like "improve our services" or "analytics purposes" without saying exactly what data is collected or how long it is kept.

A few specific things to look for in a privacy policy: Does it say the company reads the content of your documents? Does it mention "machine learning" or "AI training" — if so, your content may be used to train models. Does it say data is "anonymized" or "aggregated" — this usually means the company is not storing your name with the data, but it can still be re-identified in some cases. Does it mention third-party services like analytics tools or cloud storage providers — if so, your data goes to those companies too.

If the privacy policy is unclear, you can also check the editor's settings menu. Many editors have a "Privacy" or "Data" section where you can see what is being collected and sometimes turn off certain types of tracking. Google Docs has a "Privacy" section in settings. Microsoft Word has a "Privacy Options" menu. If an editor does not offer any way to see or control what is being checked, that is itself a sign that the company is not being transparent about its practices.

The difference between what is checked and what is stored

An important distinction: a company can check something without storing it permanently. For example, an editor might scan your document for viruses every time you open it, but delete the scan results when ready after checking. Or it might track your activity in real time to show you statistics, but delete the detailed logs after 30 days and keep only summaries.

The privacy policy should tell you how long data is kept, but often uses phrases like "as long as necessary" or "for business purposes" without giving a specific timeframe. Some companies keep activity logs for 90 days, others for a year or longer. Some delete content after you delete the document, others keep backups for months. If the policy does not specify, you can assume the company keeps data longer rather than shorter — deletion costs money and effort, so most companies keep data by default.

This matters because even if you are comfortable with the editor checking something, you may not be comfortable with it being stored. A document editor that scans your content for viruses but deletes the scan when ready is less risky than one that stores copies of your documents on its servers indefinitely. When comparing editors, look for specific retention periods in the privacy policy, not just what is being checked.

Frequently Asked Questions

Does Google Docs read the words inside my documents?

Yes. Google Docs sends your document content to Google's servers so you can access it from any device, and Google also analyzes the content to improve features like spell-check and grammar suggestions. Google says it does not use your documents to train advertising profiles, but it does use some content to improve its AI models. If you want Google to not see your documents, you must use a local-only editor.

Can I turn off tracking in Microsoft Word?

Partially. Word has a "Privacy Options" menu where you can turn off optional features like connected experiences and cloud-based features. However, some basic activity tracking cannot be fully disabled — Microsoft collects data about crashes and performance issues to improve the product. If you want to minimize tracking, use the offline version of Word rather than the web version, and disable cloud features in settings.

What does "anonymized data" mean in a privacy policy?

Anonymized data has your name and account information removed, so the company cannot directly link it back to you. However, anonymization is not always permanent — researchers have shown that anonymized data can sometimes be re-identified by combining it with other information. If a privacy policy says data is anonymized, it is usually safer than non-anonymized data, but not completely private.

Do local-only editors like LibreOffice check anything?

LibreOffice and similar local-only editors do not check content, activity, or device information because they have no connection to company servers. They may check for software updates when you open the program, but this is minimal. The tradeoff is that you cannot sync documents across devices or access them from anywhere — everything stays on your computer.

If I delete a document, does the company delete it too?

Usually not when ready. Most cloud editors move deleted documents to a trash or recycle bin for 30 days before permanently deleting them. During that time, the company still has a copy. After the retention period, the document is usually deleted from the company's main servers, but backups may be kept for longer for disaster recovery purposes. Check the specific editor's policy for exact timeframes.