Don't trust us. Check.
"Your files never leave this device" is a claim every app makes and almost none lets you verify. This one you can falsify yourself, from your own browser, in about five minutes. Here's the exact procedure — if any step fails, we're lying, and you should say so loudly and publicly.
1 · Watch the network
- Open devtools. On a computer: F12 (or right-click → Inspect), then the Network tab. This panel shows every byte the page sends or receives — the browser records it, not us, and we can't hide from it or turn it off.
- Hard-reload the analyzer with the panel open. Every request in the list comes from this domain. No CDNs, no fonts from Google, no analytics endpoints, no "error reporting." The page loads itself and nothing else.
- Now run the demo — or drop a real export. Watch the request list while the numbers compute. Nothing new appears. Parsing happens inside your browser; there is no upload, because there is nowhere to upload to.
2 · Pull the plug
- Visit once, then go offline. Airplane mode, wifi off, whatever you like. Reload. The entire app still works — both pages, the demo, your saved months. A page that needs your data on a server cannot do this. Working with the cord cut is the strongest form of the claim.
3 · Read the policy the browser enforces
Promises can be broken by a code change you'd never notice. So the no-egress rule is also declared as a Content-Security-Policy — an instruction the browser enforces against us. This page ships under exactly this policy (check the response headers in the Network tab, or view source):
default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'; base-uri 'none'; form-action 'none'
connect-src 'self' means your browser will refuse any attempt by this page to contact another server — even if a malicious update tried. form-action 'none' means nothing here can even submit a form. The policy is public, machine-checked on every load, and any weakening of it would be visible in this exact spot.
4 · Read the source
- The code is public: github.com/malignantz/HonestHourly. It's a static site — what you read there is what your browser runs, with no server-side anything to take on faith. Street addresses in your files are cut to 5-digit ZIP codes at the parsing boundary, and an automated test fails if one leaks past it.
Why this beats a privacy policy
A privacy policy describes intentions. An architecture describes capabilities. A dishonest version of this app would have to show requests in your network tab, break in airplane mode, or ship a weaker CSP — all three are checkable in minutes, by anyone, forever. That's the deal: don't believe us, audit us.