EVERY FILE IS TALKING ABOUT YOU.
Photos carry the coordinates they were taken at. Documents carry the name of whoever last saved them. Exports carry the path they came from. Drop a file below and read all of it — then take a clean copy back.
- Processing
- In this tab. Nothing is uploaded.
- Enforcement
connect-src 'none'— the browser refuses to let this page open a connection.- Verify it
- Open DevTools → Network, then use the tool. The counter above stays at zero.
What happens to your file
"Nothing is uploaded" is easy to say. Here is exactly what that means, and how to check it for yourself.
Your file never leaves this tab
- The contents of the file
- Its name, size or checksum
- Everything found inside it — coordinates, serial numbers, authors, timestamps
- The cleaned copy you download
- Any report you export
None of it is transmitted anywhere. There is no upload endpoint to send it to:
this origin serves files and nothing else, so POST and
PUT are answered 405, and any request body over
1 KB is refused with 413 before it is even read.
The only thing downloaded is the tool itself
- Five requests when you opened this page — the document, its stylesheet, the application, the parser and the icon
- They are byte-identical for every visitor
- They all happen before you choose a file, and none of them ever repeat
That is ordinary page loading, the same as any website. Once those five files have arrived, this page never contacts the server again — inspecting, cleaning and saving all happen on your own machine.
Don't take our word for it
- Open your browser's developer tools, switch to the Network tab, then inspect a file. The list stays empty and the counter at the top of this page stays at zero.
- Or settle it completely: load this page, disconnect from the internet, and carry on using it. Everything still works.
The page is served with connect-src 'none', so the browser itself
refuses to let this code open a connection — even if the code were replaced.
What this cannot promise
One risk cannot be engineered away: you are trusting the JavaScript this server sends you. It is mitigated — there are no third-party scripts, no dependencies in the shipped bundle, and a policy that blocks outbound connections — but a compromised origin could serve different code with a different policy.
If that matters to you, load this page once, disconnect from the network, and keep working. Everything here runs offline by design.