I am already well served by ghostscript, GIMP, Imagemagick, etc:

Optimize PDF:

    #!/bin/bash
    INPUT="$1"
    OUTPUT="$(mktemp --suffix=.pdf)"
    gs -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -dPDFSETTINGS=/ebook \
    -dNOPAUSE -dQUIET -dBATCH -sOutputFile="$OUTPUT" "$INPUT"
    mv "$OUTPUT" "$INPUT"

Merge PDF:

    #!/bin/sh
    gs -q -dNOPAUSE -dBATCH -sDEVICE=pdfwrite \
      -dCompatibilityLevel=1.3 -dPDFSETTINGS=/ebook \
      -sOutputFile=merged.pdf "$@"

And so on and so forth.

Moreover, I see a webapp and I immediately assume everything I do in this app is exfiltrated and abused.

I can check that the webapp advertised above is indeed local-first, but I can't be 100% sure they don't steal my data in a way I did not foresee, e.g. via websockets or cookies.

Because I learnt this the hard way by being on Instagram and Gmail.