Your browser blocks file exfiltration.

The policy behind the promise

Every ordinary FileGizmo tool is served with this browser-enforced Content Security Policy:

default-src 'self'; script-src 'self' blob: 'wasm-unsafe-eval' [one exact theme-script hash]; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' blob:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests

The decisive rule is connect-src 'self' blob:. It prevents page scripts, workers, WebSockets, and similar browser APIs from sending data to another origin. The blob: allowance is origin-bound local browser memory used internally by the image model; it is not a network destination. Processing code, fonts, workers, WebAssembly, and machine-learning models are self-hosted.

'wasm-unsafe-eval' permits the browser to compile self-hosted WebAssembly engines such as QPDF. The origin-bound blob: script allowance supports ONNX Runtime’s generated module worker. Neither permits JavaScript eval(), inline scripts beyond the exact theme hash, or an external network origin.

Uploads to third-party origins: blockedThe restriction is enforced by the browser, not by a promise to delete a remote copy later.

One narrow, visible exception

Address to coordinates must contact a map-data provider to turn an address into coordinates. Only that route permits connections to https://api.geoapify.com. Its interface explains that each address and the user-provided API key go directly to Geoapify before processing starts. The global policy is not weakened.

What FileGizmo does not collect

FileGizmo uses no telemetry and no cookies. There are no accounts, advertising trackers, remote file queues, or FileGizmo conversion servers. Tool files and outputs are handled in browser memory or temporary local browser storage. Crash-recovery data is origin-scoped, contains edit state rather than silent raw-file copies, expires after seven days, and can be cleared by the user.

Defence in depth

FileGizmo also prevents framing, restricts browser permissions, blocks plugin objects, upgrades insecure requests, and uses COOP and CORP headers to separate browsing contexts and same-origin resources. COEP require-corp is deliberately omitted because production-header testing shows that it breaks the QPDF WebAssembly worker; release QA locks that compatibility decision. Workers remain isolated by tool, and generated pages are checked for unexpected external script or stylesheet references.

Verify it yourself

FileGizmo is open source: audit the code, security headers, dependency lockfile, and reproducible QA evidence yourself. You can also open the browser Network panel, clear it, process a harmless sample, and confirm that the tool sends no file-processing request. Read the converter safety verification guide for a careful test procedure.

A second test

Disconnect the internet. Watch it still work.

First open Word counter while connected and wait for it to load. Turn off the connection, reload the page, and type a sentence. The count still updates because the cached tool runs locally.

Honest boundary: the first visit needs a connection. A tool with a large engine or model must load those assets once before that workflow can use them offline. Clearing site data removes the cache.

Report a security issue

Please use GitHub private vulnerability reporting. Do not publish exploit details, credentials, or another person’s files. The machine-readable disclosure record is available at security.txt.