04 / DATA BOUNDARY
Every available Toolars tool declares where input is processed. Read the plain-language boundary, then verify it — audited third-party hosts, served security headers, and the checks behind them.
Numbers are derived from the runtime registry at build time — none are typed by hand.
Tool input and output stay in the active tab unless you explicitly submit or export something.
Available local-first tools transform text, code, images, and documents with browser APIs and lazily loaded code.
Authentication, favorites, explicit feedback, and tool requests use narrow account contracts when Supabase is configured.
A local processing statement is not a substitute for device security or careful handling of downloaded files.
These counts are computed from the catalog and the runtime privacy contract when the site builds. If the two ever disagree, the offending tools are listed here instead of being silently hidden.
A tool only counts as local when its manifest says processingLocation browser, inputLeavesDevice false, and retention none — the label is generated from the contract, never written as copy.
| Category | Local | Cloud | Hybrid |
|---|---|---|---|
| Writing | 7 | 0 | 0 |
| Image Studio | 16 | 0 | 0 |
| Design | 17 | 0 | 0 |
| Developer | 31 | 0 | 0 |
| Social Mockups | 11 | 0 | 0 |
| PDF Tools | 10 | 0 | 0 |
| Files & Utilities | 12 | 0 | 0 |
A deliberately short list. Tool workspaces load zero third-party scripts; heavy runtimes ship as same-origin Web Workers, WASM, and static assets. Everything below is what the site shell itself can reach.
| Service / host | Type | Purpose | Data boundary |
|---|---|---|---|
track.toolars.com | Analytics | Receives production analytics events through PostHog's managed first-party reverse proxy, served via Cloudflare. | Cookieless, allowlisted events only: sanitized page views, nineteen named product events, web vitals, and exceptions. Never tool input, output, file names, or search queries. The SDK lazy-loads only on the production origin. |
us.posthog.com | Analytics | Identifies the managed PostHog application for UI links and configuration. | Events do not flow to this host; collection goes to the proxy row above. |
project ref .supabase.co (NEXT_PUBLIC_SUPABASE_URL) | Account backend | Authentication, favorites sync, newsletter subscription, and feedback storage. | Reached only on explicit actions you take: signing in, subscribing, or submitting a form. Workspaces never call it, and only the publishable key exists in the browser bundle. |
avatars.githubusercontent.com | Profile image | Profile pictures for accounts that sign in with GitHub. | Loaded through the strict image-optimizer allowlist, and only rendered in the signed-in header menu. |
lh3.googleusercontent.com | Profile image | Profile pictures for accounts that sign in with Google. | Same strict image allowlist; nothing loads until you are signed in. |
buymeacoffee.com | Outbound link | Optional creator-support link in the footer. | A plain outbound link with no embed and no script; it receives no data about your tool usage. |
chromewebstore.google.com | Outbound link | Extension install and listing links. | Outbound only, opened in a new tab; the store sees an ordinary visit, never workspace content. |
x.com / github.com | Outbound link | Links to Toolars on X and its public GitHub repository. | Opened only when you follow a link. No embedded social scripts or automatic requests to these sites; no tool input or output is attached. |
fonts.googleapis.com / fonts.gstatic.com | Build-time fetch | Build-time download of the Barlow font files through next/font. | Fonts are served from this site's own static paths at runtime; your browser makes no Google Fonts request while using Toolars. |
vercel.app (hosting platform) | Infrastructure | Hosting platform that serves every Toolars response. | Sees the request metadata any host sees (IP, headers); no tool input or output passes through it. |
cloudflare.com (DNS + proxy layer) | Infrastructure | DNS for toolars.com and the proxy layer behind the analytics host. | Handles the same request metadata as the hosting layer; no workspace content flows through it. |
Inventory audited from the deployed source on 2026-09-19: a full-tree search for external origins, the image allowlist in next.config.ts, and the analytics contract in ADR 007.
These are the response headers on every Toolars page, read from the same typed declarations that produce the configuration — the table cannot drift from what ships.
| Header | Value |
|---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains |
X-Content-Type-Options | nosniff |
Referrer-Policy | strict-origin-when-cross-origin |
X-Toolars-Release | a2f07a5231e271e8 |
Content-Security-Policy: deliberately not set site-wide
Strict-Transport-SecurityX-Content-Type-OptionsReferrer-PolicyX-Toolars-ReleaseToolars does not send a site-wide Content-Security-Policy header yet, and this page will not pretend otherwise. A CSP that blocks the wrong origin would break account sync or the approved analytics proxy, so the control is being designed against real routes and browser behavior first, per ADR 010. The headers above ship today, and every network boundary listed here is enforced in code and covered by tests. docs/adr/010-local-processing-evidence.md
No tooling required beyond the browser you already have. Use a harmless synthetic file or sample text — never real sensitive data, and never publish a screenshot or HAR that contains it.
These measurements were captured by scripts/capture-privacy-proof.mjs using a real browser against a production build. The harness checks for file uploads, cross-origin requests and canary leaks. The capture date and release binding are shown with the results.
For an even stronger check, repeat the run with the network disabled after warm-up: text and image tools keep working; PDF tools need their already-seen same-origin worker assets, which is why offline use is not claimed for them.
Captured 2026-09-27 · internal verification
Recorded against release 0d02cd2cc4ab3d28; this page now serves a2f07a5231e271e8. Rerun the capture harness before reading these numbers as current evidence.
A PNG → JPEG conversion plus download, with a canary marker hidden in the test file: 0 requests, 0 uploads, 0 canary leaks in the measured window.
Requests in the measured window: 0
A HEIC → JPEG conversion plus download: the lazy ~3.3 MB libheif decoder loads only from this site's own paths on first use, the measured repeat conversion makes 0 requests with 0 uploads and 0 canary leaks, and the canary-named photo never leaves the device.
Requests in the measured window: 0
/generated/runtime/7879e1c92e1bdb08/libheif.js/generated/runtime/e4aa8333fbe55ec7/libheif.wasm/generated/runtime/6c728441042ea88c/heic-decode-worker.jsOn first use the engine, worker, and each selected language pack (13 available, 0.4–2 MB each) load only from this site's own paths; repeat recognition runs in English and Simplified Chinese each make 3 requests and 0 uploads.
Requests in the measured window: 3
GET /generated/runtime/e4d26dedc913c87f/worker.min.jsGET /generated/runtime/775a35df6f2ae100/tesseract-core-lstm.wasm.jsGET /generated/runtime/d8438d6a4fba7bc3/eng.traineddata.gz/generated/runtime/775a35df6f2ae100/tesseract-core-lstm.wasm.js/generated/runtime/89456b34c2769c9a/chi_sim.traineddata.gz/generated/runtime/d8438d6a4fba7bc3/eng.traineddata.gz/generated/runtime/e4d26dedc913c87f/worker.min.jsLoading the bundled sample, rotating it, and downloading the result: 0 requests, 0 uploads, 0 canary leaks in the measured window.
Requests in the measured window: 0
These results cover the captured runs only. They are internal checks, not an independent security audit.
Local-first is an architecture here, not a slogan. Three mechanisms keep your data in the tab.
Hashing, regex evaluation, diffs, encoding, and streaming run inside dedicated Web Workers compiled from TypeScript by scripts/build-tool-workers.mjs. Workers are same-origin scripts served from this site, so the tab stays responsive while multi-megabyte inputs churn off the main thread.
The OCR engine (about 4 MB) and each 0.4–2 MB language pack, plus the PDF runtime, load from this site's own static paths only after you open the tool. Recognition and parsing execute locally; nothing is uploaded for processing.
A tool's execution bundle downloads when you open that tool — never on the catalog or home pages. Browsing the catalog ships metadata only, which is easy to confirm in the same Network panel.
One of the checks below is public: the privacy-proof harness is published under MIT at https://github.com/aixtral/toolars-open, so you can rerun it against the live site yourself. The remaining commands run in the private repository with pinned Node and pnpm versions, and their methods are summarized here.
Machine-readable verification receipt — the commands, the measurements, and what this does not prove: receipt JSON.
| Script | Command | What it verifies |
|---|---|---|
Local-processing proof harnessscripts/verify-local-processing.mjs | corepack pnpm verify:local-processing | Rebuilds the site, blocks the network in a fresh browser context, reruns representative workflows with synthetic canaries, and compares source and build fingerprints into a receipt. Any retry, skip, or drift fails the run. |
Open-core dependency auditscripts/audit-local-core.mjs | corepack pnpm audit:local-core | Maps the execution dependency graph of the open-surface candidates and records source SHA-256 hashes, installed dependency versions, and license texts. |
Worker buildscripts/build-tool-workers.mjs | corepack pnpm worker:build | Compiles every browser Web Worker from its TypeScript source into a content-hashed file under public/generated, so the served worker is exactly the reviewed source. |
Benchmark harnessscripts/benchmark-tools.mjs | node scripts/benchmark-tools.mjs | Measures the largest accepted input, median run time, and zero-leak network isolation per tool, then writes the typed data behind the benchmarks page. |
Privacy-proof capture harnessscripts/capture-privacy-proof.mjs | node scripts/capture-privacy-proof.mjs | Drives an image conversion, the OCR engine, and a PDF rotation in headless Chromium while recording every request, including dedicated Web Worker fetches, then writes the evidence JSON this page renders. Fails on any upload, cross-origin request, or canary leak. |
The benchmarks page renders data produced by the harness in a real headless browser, including the canary runs that prove inputs stay on the device.
Local-first does not mean network-free. These features send data because they cannot work otherwise, and each one says exactly what leaves the device.
Signing in syncs favorites and account state through Supabase Auth and Postgres with row-level security. Tool input and output are never part of that sync — every workspace works signed out.
The footer form sends only the email address you typed to a Supabase RPC. Analytics events about subscribing never carry the address, per the ADR 007 allowlist.
These forms submit the text you wrote plus form metadata through an authenticated server action, and each form states its exact payload before you send. Workspace content is never attached.
On first use, the OCR tool downloads about 4 MB of engine files plus a 0.4–2 MB language pack per selected language, all from this site's own /ocr paths. The downloads are same-origin; your image and the recognized text stay in the tab, and downloaded packs persist only in your browser's offline cache.
PDF import and export restart the PDF.js worker, which refetches same-origin static assets that were already seen during warm-up. That is why full offline use is not claimed for the PDF tools.
Extension, support, and social links lead to the Chrome Web Store, Buy Me a Coffee, X, and GitHub. These are plain outbound links with no embedded third-party scripts.
No third-party security audit and no compliance certification. The separately published verification harness and the two local Node packages are MIT-licensed; the website's own source is not published and no license to it is granted. This page shows only what is verifiable today.
Third-party notices — the components this site redistributes and their full licence texts: notices and licence texts.
Contract description revision: 2026-09-26.1
Local means workspace inputs are processed in the browser. Loading a page, worker or codec can still require a network request. Account actions and allowlisted cookieless analytics have separate service boundaries.
Offline contract a2f07a5231e271e8 covers 49 tools after each has been prepared in that browser. Cached resources can be evicted. Workflow offline reload is not guaranteed; PDF steps may still need static worker assets.
To check a local claim, load the required operation with a non-sensitive sample, then observe Fetch/XHR, WebSocket and worker traffic while processing a fresh sample. Test offline reload separately. A clean network trace covers that run only; it is not an independent security audit.
Yes for every available tool: each one has a typed runtime manifest declaring processing in the browser, no input leaving the device, and no retention. The labels on this page are generated from those manifests. Any future cloud or hybrid tool must disclose its boundary before it ships.
A misdesigned CSP would break account sync or the approved analytics proxy, so the control is being built against the real routes first, per ADR 010. Until then this page discloses the headers that do ship and the external connections that are possible, and the network boundaries are enforced in code and covered by tests.
No. PostHog runs cookieless with autocapture, session recording, persistence, and person profiles disabled. The allowlist admits sanitized page views, nineteen named product events, web vitals, and exceptions — never input, output, file names, or search queries — and events leave only through the first-party proxy host.
They are derived from the runtime registry and catalog at build time, and the benchmarks page shows the measured runs behind its figures. If a catalog label and a runtime manifest ever disagree, the mismatch is printed on this page instead of being averaged away.
The benchmarks page renders data produced by the harness in a real headless browser, including the canary runs that prove inputs stay on the device.