Security
Every claim below is followed by the steps that let you check it in about a minute. If a claim does not hold on your machine, that is a bug — report it.
| Claim | How you verify it |
|---|---|
| Files never leave your browser | Open DevTools → Network, drop a CSV, and watch the request list. No request carries the file or any part of it. The parser runs in a Web Worker on your machine. |
| Works without a connection once loaded | Load the page, drop a CSV, then set DevTools → Network → Offline. Parsing, fixing and exporting keep working and the licence check fails (free limit applies). Reloading the page does need the network: there is no service worker or offline cache yet, so a reload while offline shows the browser's error page. |
| Only the licence key is sent | The single endpoint is POST /api/license/verify. Its body is {"key":"…"}. Inspect it in the Network panel: no file name, no row count, no content. |
| No file history is kept | Reload the page and the tool is empty. localStorage holds only UI preferences and a licence key; the server stores licence keys as SHA-256 hashes and nothing about your files. |
What the server does store
- Licence keys (hashed), tier, optional e-mail, creation and expiry timestamps, verification count.
- Verification events with the key prefix and the requesting IP, for abuse limits.
- No file names, no row contents, no CSVs — there is no upload endpoint at all.
Limits of the claim
- Your browser, extensions and any proxy you use are outside our control.
- The page is served over the network, so the HTML/CSS/JS themselves are downloaded once, like any website. Files you drop in are not.