Intent does not change the classification
GDPR defines personal data by what it is, not by whether it was disclosed deliberately. An author name, a device identifier and a set of coordinates embedded in a shared file are personal data being processed, and they fall inside the same obligations as any field in a database.
Where it tends to matter in practice
Files published on a website. Documents attached to emails leaving the organisation. Photographs of staff or premises. Data shared with a processor or a partner. Responses to subject access requests, which are frequently exported as documents carrying the properties of whoever compiled them.
Transfers and third-party tools
Uploading a document to an online processing service is itself a transfer to a third party, and possibly out of the region. That is a separate assessment to make before using any cloud-based cleaning tool. Processing entirely in the browser avoids the question, because nothing is transferred.
Not legal advice
This is a description of a common gap, not a compliance opinion. Your data protection officer or counsel should decide what your obligations actually are.