Privacy

Nothing you give a tool is uploaded. Files, text and images are processed by JavaScript and WebAssembly running in your browser tab. There is no server that receives them, and there is no database to store them.

Why you can believe that

Every page is served with a Content-Security-Policy whose connect-src is limited to this site itself (plus blob: and data:, which are local to your browser). The browser refuses any attempt by the page, or by code you run in the Sandbox, to send data to another host. You can check it: open developer tools, look at the Network tab while you use a tool, and read the response headers.

The Custom JavaScript block runs in a Worker served with connect-src 'none', so it cannot make network requests at all.

One page is slightly looser: Remove Background adds 'unsafe-eval' to script-src, because its machine-learning runtime needs it. Its connect-src is the same as everywhere else. The model, the OCR engine and the AVIF encoder are all served from this site, never from a CDN.

What is stored

• Your theme choice and any Sandbox tools you save, in your browser's local storage. They never leave your device. Clear them any time in your browser settings.
• A service worker caches the site's own files so it works offline.

What we do not do

• No analytics, no cookies, no fingerprinting, no ads, no third-party scripts, no third-party fonts.
• No accounts, so no personal data to hold.

Hosting

The site is static files on Vercel. As with any host, Vercel's infrastructure sees ordinary request metadata (IP address, requested page) when you load a page. It never sees your files, because they are not sent.

Shared links

A Sandbox share link stores its recipe after the #. Browsers do not send that part to servers. Anyone you give the link to can read the recipe, including any input you chose to include.