Cookie Policy
Last updated:
We set no cookies. This page exists because people look for it, and because the two localStorage values we do set deserve the same disclosure.
This document was prepared by the operator of this site and is not legal advice. If you are relying on it for a compliance decision, have a qualified lawyer in your jurisdiction review it.
1. Cookies we set
None. The Service does not set any cookie — not first-party, not third-party, not session, not persistent, not advertising, not analytics.
2. Why we use localStorage instead
Two preferences need to survive a page reload: your language, and your advertising choice. We store both in localStorage.
This is not a cosmetic distinction. A cookie is attached to every subsequent HTTP request to the domain, which means it is visible to intermediaries, to any third-party resource loaded on the page, and to logs. A localStorage value is readable only by script running on this origin, and is never transmitted.
For a product whose central promise is that nothing leaves your machine, using a mechanism that attaches data to every request would undermine the promise for no benefit.
3. What is stored
No value is transmitted to us. All are readable only by this origin and can be cleared at any time from your browser's site-data settings. In addition, a per-tab sessionStorage marker records which project is live in that tab and disappears with the tab, and resumable session snapshots (analysis structure, never file contents) are kept in IndexedDB until you clear them or the five most recent push out the oldest.
| Key | Value | Set when | Lifetime |
|---|---|---|---|
cb.locale | A language tag, e.g. vi | You choose a language from the switcher | Until you clear it |
cb.target | The export destination you selected | You pick a "Sending to" target | Until you clear it |
cb.pushes | An index of transfers created from this browser: names and timestamps, never decryption keys | You use "Continue on another device" | Until you clear it |
cb.salt | A random 8-character salt for the coarse abuse-prevention identifier described in the Privacy Policy | The first fair-use check | Until you clear it |
4. Third-party cookies
Cloudflare, which hosts the Service, may set cookies necessary for the security and operation of its network. Those are governed by Cloudflare's own cookie and privacy policies and are outside our control.
If advertising is ever enabled — which requires the prior amendment of this Policy described above — the advertising provider may set its own cookies or storage. We will name the provider, describe what it stores, and amend this Policy *before* enabling it. At the time of writing no advertising provider is enabled, and our Content-Security-Policy permits no advertising origin.
5. How to control storage
Every major browser lets you inspect and delete site data: look for "Site settings" or "Privacy" and find the entry for this domain. Clearing it resets your stored preferences and local session history.
Blocking all site data will not break the Service. You will be asked your language preference again on each visit and local resume history is forgotten; because the Service loads no advertising, nothing else changes.
Note that browser-level tracking protection, including Safari's Intelligent Tracking Prevention and Firefox's Enhanced Tracking Protection, does not affect the Service, because there is nothing to protect you from.
6. Do Not Track and Global Privacy Control
We honour both in the strongest form available: the Service loads no advertising, sets no tracking cookies and runs no analytics, so there is nothing for a DNT: 1 or Sec-GPC: 1 signal to opt out of — the Service behaves the same way for every visitor, as if both signals were always set. If processing that those signals govern is ever introduced, this Policy is amended first and the signals are honoured.
This is enforced in code, and the check is listed in our security documentation so you can verify it.