A website can help with a file without receiving it.

The local-first rule

Choosing a file gives the current page permission to read that file. The page transforms it in browser memory and produces a temporary download URL. The original and result are not submitted to our web server by these tools.

Verify the local-processing claim

Every current tool page declares a Content Security Policy with connect-src 'none' and form-action 'none'. After the HTML, styles, and JavaScript load, that document policy blocks the page from opening fetch, XMLHttpRequest, WebSocket, EventSource, beacon, and form-upload connections. The visible “Inspect this tool’s code” link opens the exact deployed JavaScript module for that workspace.

For an independent check, open the browser developer tools, select the Network panel, clear it after the page finishes loading, and use the tool. You can also disconnect the network after loading: local processing and downloads continue to work. Navigation links still leave the page only when you activate them.

The separately scoped service worker can retrieve Vader's public static assets only when you activate “Download for offline use”; expect same-origin requests during that explicit operation. It never receives a processed file or workspace item. This proves the data path of the delivered page under the browser policy; it is not a claim that loading or explicitly caching the website makes no request. Review the next section and the privacy statement for ordinary server metadata.

Offline without silent retention

The PWA separates public application code in Cache Storage from user-imported files in an IndexedDB workspace. The complete offline copy is opt-in, workspace files require an explicit import, storage usage is visible, and each category has its own erase control. Installing the app does not transform temporary tool inputs into saved documents.

What the server still sees

Loading any website makes a network request. Our host can therefore receive ordinary connection metadata such as IP address, requested path, user agent, timestamp, and error information. That is different from receiving the file you select inside the tool.

Why the first tools are intentionally modest

Image conversion, subtitle timing, and structured-text conversion can be useful without remote compute. Heavy media retrieval, arbitrary URL fetching, and unrestricted file hosting create copyright, abuse, privacy, and infrastructure risks that do not belong in an early release.

What comes next

We will expand around repeatable file tasks and open formats. Features that require a backend will receive strict limits, a clear retention statement, and an abuse review before release.