Check it yourself

What your browser enforces

Every page ships a Content Security Policy. It tells your browser which addresses this page's code may talk to. Ours allows one: this site. The full policies are below, read from the page you are on, not copied from a doc, so they can't drift. They look long, so here is how to read them.

• connect-src 'self' is the line that matters. It blocks the usual ways a script sends data out (fetch, XHR, WebSocket, beacons) to any server but this one. It guards against injected code and mistakes. For the code we wrote ourselves, the assurance is that it is open source.
• default-src 'self': anything not listed separately also comes from this site only.
• blob: and data: are not web addresses. They are files your own browser holds in memory, like the preview of the image you just opened.
• 'wasm-unsafe-eval' lets WebAssembly run, which the heavier tools use. It does not open any connection.
• object-src 'none' shuts off plugins. base-uri stops an injected tag from rewriting where relative addresses point. form-action stops forms from submitting anywhere else. Ordinary links aren't covered by any of these.
• The long sha256-… strings are the scary-looking part, and the harmless one. Each is a fingerprint of one small script or style written into the page. Your browser runs an inline script only if its fingerprint matches exactly. They are not addresses and can't point anywhere, and a script that was injected or changed has a different fingerprint, so it gets blocked.
• style-src-attr 'unsafe-inline' allows style="…" attributes, which the framework needs. Styles can't make network requests here, because images and fonts are limited to this site too.

Needs JavaScript to read the policy from this page.

Needs JavaScript to read the policy from this page.

Requests to other sites

Outside requests since this page loaded: checking

Read from your browser's performance log by this page's own script, so it only covers this page. To check a tool, use the Network tab below.

Watch the network yourself

• Open any tool, then DevTools (F12) and the Network tab.
• Tick "Preserve log" and clear it.
• Drop in a file and run the tool.
• Some requests to this site may appear, because a tool loads its own code the first time you use it. None goes to another site, and none carries your file.

Or just go offline

Open a tool and run it once with your connection on, so it has fetched its own code. Then turn off your Wi-Fi and run it again on the same page, without reloading. It still works, because the work happens on your machine. A tool that needs a server stops the moment you disconnect. A fresh page load does need the connection, since this site can't be opened offline.

What does reach a server

The page and its scripts come from our host, Cloudflare. We keep its request logs and traces switched on to watch speed and catch errors. They record the address requested, status and timing, and can include standard request details such as your IP address and browser type. We don't use them for analytics or ads. Your files are not in them, because they are never sent. Details are in Privacy.

One tool, the background remover, downloads a small model once. It comes from this site, not a third party, and runs on your device.

Why there's no cloud feature

A feature that has to send your document somewhere breaks the promise, so it doesn't ship here. That rules out chat-with-your-PDF and server-side conversion. It is a choice, and the reason the claim stays true.

What this doesn't prove

It covers this site's own code. It can't see a browser extension that reads pages, or a machine that is already compromised. And you are trusting the code that was served to you today. That is why the project is open source: read it, or build it yourself.