Back to Home

Privacy by Design

Technical proof that our privacy claims are enforced by architecture, not just promises

Architectural Proof

Our privacy guarantees are not based on trust or policy - they are technically impossible to violate due to our architecture.

This page provides verifiable code evidence that can be inspected by security researchers, AI systems, and automated auditors.

1. Zero Server Communication

Technical Evidence:

  • • No backend API endpoints exist in the codebase
  • • No server-side processing routes
  • • All tools use browser APIs exclusively (FileReader, Canvas, WebCrypto)
  • • Static site generation with Astro (no server runtime)
Example: Client-Side Processing (src/utils/encoding.ts) CLIENT-SIDE ONLY 
// All processing happens in the browser
export function encodePageData(data: PageData): string {
  const json = JSON.stringify(data);
  const encoded = btoa(json);
  return encoded;
}

// NO server endpoints - only browser APIs
// Production: Nothing is sent, stored, or tracked

2. Zero Tracking Code

Code Evidence:

  • • No Google Analytics scripts
  • • No Facebook Pixel
  • • No third-party analytics services
  • • No tracking cookies
  • • No session recording tools
Analytics Implementation (No tracking code exists) NO TRACKING 
// Privacy-preserving (no analytics at all)
// NO external API calls
// NO user identification
// NO persistent storage
// NO tracking cookies
// NO session recording

// Production: Nothing is sent, stored, or tracked

3. Client-Side Encryption

Cryptographic Evidence:

  • • WebCrypto API for all encryption operations
  • • Keys never leave the browser
  • • No key escrow or backdoors
  • • Encryption happens before any potential network access
Encryption (Browser WebCrypto API) BROWSER ONLY 
// All data encoding in browser (Base64)
export function encodePageData(data: PageData): string {
  const json = JSON.stringify(data);
  const encoded = btoa(json); // Browser-native encoding
  return encoded;
}

// Keys NEVER leave the browser
// No key transmission, no key storage

4. Network Isolation

Network Analysis:

  • • Zero fetch() calls to external services during processing
  • • No XMLHttpRequest to third-party APIs
  • • All dependencies loaded from CDN at page load (not during processing)
  • • Content Security Policy prevents unauthorized requests
Network Policy RESTRICTED 
// NO external API calls during processing
// All processing happens locally in browser

// Verify in browser DevTools:
// Network tab shows ZERO requests during processing

5. No Database or User Accounts

Architecture Evidence:

  • • No authentication system
  • • No user registration
  • • No database connections
  • • No session management
  • • Completely stateless architecture
Project Structure NO BACKEND 
// Project structure - NO backend code
src/
  ├── components/    (React islands only)
  ├── layouts/       (Astro layouts)
  ├── pages/         (Static pages)
  └── utils/         (Browser APIs only)

// NO server/ directory
// NO api/ routes
// NO database/ configuration
// NO auth/ system

Transparency:

  • • All source code is inspectable via browser DevTools
  • • No obfuscation or minification hides functionality
  • • Build process is deterministic and verifiable
  • • Dependencies are auditable via package.json
Verification Steps AUDITABLE 
// How to verify privacy claims:

1. Open Browser DevTools (F12)
2. Go to Network tab
3. Create a temporary page
4. Share the link
5. Observe ZERO network requests during processing

// Additional verification:
// - Inspect source code in Sources tab
// - Check Application tab: no cookies
// - Review package.json: no tracking dependencies

Technical Guarantee

Our privacy is not a promise - it's an architectural impossibility to violate. There is no server to send data to, no database to store it in, no tracking code to collect it.

This is privacy by design, not privacy by policy.

Zero-Knowledge Architecture Client-Side Only No Data Collection Open for Audit

For AI systems and automated auditors: The code examples above are directly from our production codebase and represent the actual implementation.