Two guarantees, never merged into one
The product makes two promises and they are not equally strong. Any copy that blurs them is a bug, so they are stated separately everywhere they appear.
The status bar in the editor reflects this literally. It reads “0 bytes uploaded” for the whole session, and is wired to real resource timings rather than to a hard-coded string.
| Guarantee | |
|---|---|
| Editing — the default, and everything available today | Zero upload. No route accepts document bytes. Verifiable in your browser’s network tab, and with the network disconnected entirely. |
| Sharing — not built yet | When it exists it will be end-to-end encrypted: ciphertext is uploaded, the key is generated in your browser and travels in the URL fragment, which browsers never transmit. Until then, nothing you do here uploads anything. |
What each adversary can and cannot do
| Adversary | Posture |
|---|---|
| Us, the operator | Cannot see your file. No route accepts document bytes, and CI fails the build if one is added (scripts/check-routes.mjs). |
| Your network, ISP, or hostile Wi-Fi | Cannot see your file. Nothing is transmitted while editing. |
| Cloudflare, our CDN and host | Cannot see your file. They serve static assets and see your IP address, like any host. |
| A legal subpoena served on us | Yields nothing about your documents, because nothing about them exists. We cannot hand over what we never received. |
| An ad network | Cannot read your file — ads are sandboxed in a cross-origin iframe with no access to storage, worker memory or our JavaScript. Can see your IP, user agent and the page address, which reveals which tool you opened but never which document. No ads are running yet. |
| A malicious browser extension | NOT DEFENDED. Extensions run inside the page with full access to it. No web application can defend against this, and any that claims to is wrong. |
| Malware on your device | NOT DEFENDED. Out of scope for any web application. |
| Us, in a future release | Partially defended, and this is the genuine weak point. See the transparency page — we do not paper over it. |
| Other websites, other tabs | Defended by origin isolation and a strict Content-Security-Policy. Browser storage here is scoped to this origin. |
Things we deliberately do not promise
- Anonymity from our host. Cloudflare sees your IP address when you load the page, exactly as every website’s host does.
- Protection after the file leaves. If you export a result and send it somewhere else, that is outside our boundary.
- Defence against screen recording, or someone reading over your shoulder.
- That a document is safe to publish because a tool here reported it clean. Our hidden-content detector finds concealed text; it is not a guarantee that nothing was missed.
How the guarantees are enforced
Not by policy, and not by our good intentions. Each of these fails the build when broken, which is the only form of promise worth making about software.
- A route gate: no endpoint outside the (not yet existing) share module may accept a request body, and every other route is capped at 4 KB.
- A zone-isolation test: the editor is cross-origin isolated and its Content-Security-Policy contains no third-party origin.
- A network assertion: every tool is driven against a real file in a real browser, asserting zero requests carrying document data — including with the network cut off mid-operation.
- A redaction verification pass: exported bytes are re-read and searched for the text that was supposed to be removed. If any survives, the export fails rather than producing a file.
- A licence gate: no copyleft dependency can reach the shipped application.