Trust & privacy
Privacy isn't a promise here — it's a set of controls we enforce and test. Every claim below maps to the mechanism that makes it true.
| We claim | The control | How it's verified |
|---|---|---|
| Client tools send nothing to any server | CSP `connect-src 'self'`; no third-party origins on tool routes | An e2e network-capture test fails if a tool page makes any external request |
| They keep working with the Wi-Fi off | Service worker caches the app shell + engines; tools compute on-device | An airplane-mode e2e run exercises tools with the network blocked |
| No cookies for anonymous use | No cookie is set for anonymous visitors; preferences live in local IndexedDB | No `Set-Cookie` on anonymous responses; storage is browser-local only |
| No third-party scripts, no tracking, no PII in telemetry | No analytics or ad scripts on tool routes; the CSP forbids them | Same CSP + network-capture test; there is no tracking code to audit |
| Money math is exact | All currency is integer paise — never floating point | Calculators ship hand-computed goldens; a mutation gate must kill ≥90% |
| Usable by everyone | WCAG 2.1 AA, full keyboard operation, both themes | Axe runs in e2e on representative pages across breakpoints and themes |
| We claim | The control | How it's verified |
|---|---|---|
| Your AI key goes to the provider, not to us | BYOK: the browser calls the provider directly where possible | If a key ever transits our server it is never stored or logged |
| Heavy tools can run in YOUR cloud | Open self-hosted runner (Docker) — you point the tools at it | The runner is open source; data never touches Demystify infrastructure |
| Server tools disclose before you upload | A pre-upload disclosure is shown for any tool that leaves the device | Server-lane tools are labelled by run-lane in the catalog and UI |
Sub-processors
Client tools use none. The few server features below rely on these processors — listed for transparency (DSS-1 D13.5). No client tool sends your data to any of them.
- Vercel — hosting & serverless functions (the site, the REST/MCP API). US/edge.
- Supabase — the optional feedback database (a note you submit + an optional contact). Migrating to ashr.work.
- Your chosen AI provider (BYOK only) — when you paste your own key, the proxy forwards your prompt to that provider using your key; nothing is stored or logged here.
Security disclosure: /.well-known/security.txt. No security certification is claimed; the roadmap is VAPT → ISO 27001 → SOC 2, and none is claimed before the report is in hand.
See for yourself
Open any tool, turn off your Wi-Fi, and keep working. Or read the quality & coverage report and the developer API to see how the three privacy lanes (on-device, your key, your cloud) fit together.