Open the document properties of almost any PDF and you will find a small block of information nobody deliberately wrote: an author name, the software that produced it, the exact minute it was created, sometimes a subject line left over from a template.
None of it is displayed when you read the document. All of it travels with the file.
What is actually in there
PDFs carry Title, Author, Subject, Keywords, Creator and Producer, plus creation and modification timestamps. Author is usually your operating system account name — which for a lot of people is their full legal name. Producer identifies the exact software and version. The timestamps are precise to the second.
The combination is more revealing than any single field. A CV can tell a recruiter your full name as configured on your laptop, which word processor you use, that the document was created three weeks ago, and that you modified it four minutes before sending.
Photographs carry EXIF: camera model, lens, exposure settings, orientation, and often GPS coordinates accurate to a few metres. A photo taken at home and posted publicly can carry your home address in a field nobody looks at.
Office documents are worse in one specific way — they can retain tracked changes and previous authors even after the changes are accepted, which has embarrassed more than one organisation publishing a document that still held its internal edit history.
How to check before you send
For a PDF, open document properties in whatever reader you have — Preview, Acrobat, Firefox — and look at the Description tab. For a photo, the file info panel in your operating system shows EXIF, including a map if location was recorded.
You can also strip PDF metadata here. That tool deliberately returns a second file listing exactly what it found and removed, because a tool that silently claims to have cleaned something gives you no way to know whether there was anything there.
What stripping does not do
This is the part that catches people out.
It is not redaction. Removing document metadata does nothing to the page content. If your name is in the letterhead, it is still in the letterhead. And text hidden under a black rectangle is still text — it can be selected and copied straight out. Several well-publicised leaks have worked exactly that way.
It does not touch embedded images. A PDF containing a photograph keeps that photograph’s own EXIF, including any GPS data.
If you genuinely need content gone rather than hidden, the reliable crude method is to render the pages to images. Rasterising flattens everything to pixels, which removes hidden layers and unrendered text as a side effect. You lose selectable text and a searchable document in exchange — a real cost, but a real guarantee.
The habit worth having
Before sending a document outside your organisation, spend five seconds in the properties panel. Most of the time there is nothing interesting. Occasionally there is your full name, your employer’s internal template name, and a timestamp you would rather not explain.