How to check that nothing you open here is uploaded

Why this is checkable at all

A browser will only let a page connect to hosts named in the Content-Security-Policy the site sends with every response. It is the browser that enforces this, not us — a page cannot opt out of its own policy, and a request to a host that is not on the list is refused before it is made.

So the question “could this site upload my file?” has a factual answer rather than a reassuring one. Read the list. If there is no host on it that could accept a document, then no page here can send one, regardless of what the code does or what we claim on any other page.

1. Read the policy we serve

Run this in any terminal:

curl -sD - -o /dev/null https://toolsbay.co/ | grep -i content-security-policy

The part that answers the question is connect-src, which controls every outbound request a page is allowed to make. Ours is:

• 'self'
• https://api.open-meteo.com
• https://geocoding-api.open-meteo.com
• https://*.google-analytics.com
• https://*.analytics.google.com
• https://*.googletagmanager.com
• https://cloudflareinsights.com

'self' is this site’s own origin, which serves static files and has no endpoint that accepts one. The two open-meteo.com hosts are the free weather API behind a single tool, the weather dashboard, which sends the city name you type and nothing else. The remaining entries are the analytics tag, which reports page views and which tool ran — never what you put into it, as the privacy policy sets out.

There is no file-accepting endpoint on that list, because there is no server behind this site at all. It is a set of static files on a CDN.

2. Watch it while it works

Open any tool, press F12, and go to the Network tab. Tick “Preserve log” if your browser offers it. Now drop in a file and run the tool.

You will see the page’s own scripts and styles load, and — depending on the tool — one request for a WebAssembly module or a PDF worker, both from this domain. You will not see a request carrying your file, because none is made. The result appears as a blob: URL, which is a handle to memory inside your own browser, not an address anywhere else.

3. Pull the plug

This is the one that needs no expertise. Load a tool page, wait for it to finish loading, then turn off your Wi-Fi or put the device in aeroplane mode. Now use the tool.

It still works. Merge the PDFs, format the JSON, convert the image — all of it completes with no network at all, which is only possible if the work was never leaving your machine. The single exception is the weather dashboard, which needs live data and says so on its own page.

What this does not claim

Being straight about the edges, because a verification page that overstates its case is just marketing with a terminal prompt in it:

• Analytics still runs. It records that a tool was used and whether it succeeded. It never receives your file, its name, its size or its contents.
• The weather dashboard does make a request. It sends the city name you search for to Open-Meteo, which also sees your IP address, as any web request does.
• This says nothing about your own device. A compromised browser extension can read any page you open, including this one. No website can promise otherwise.
• It is a statement about now. The policy is served live, so re-run the command whenever you want rather than trusting this page’s copy of it.