How LocalRun handles your files

Your files stay in this browser

Files, pasted text, passwords, keys, code, generated output, OCR text, transcripts and model results are processed in browser memory. LocalRun has no application backend, accounts, analytics, telemetry, advertising, session recording or error reporting service, and no tool request includes your content.

When you choose, drop or share a file on the home page, LocalRun reads only its first 256 KiB and last 64 KiB to suggest actions (image size, camera model, whether GPS coordinates are present, PDF version and page count, ZIP entry count). Nothing is decoded or stored. Picking a suggestion keeps the file in memory for that one tool for at most two minutes.

The network indicator in the top bar counts every request the page and its background workers make to another site since the page opened, read from the browser's Resource Timing log. It counts requests; it cannot measure bytes. Each result receipt shows the same count for that run.

First-use downloads

Most tools make no external request after the app loads. These model-backed tools download public files the first time you run them. Opening the tool alone does not start the download.

The FFmpeg media engine (about 32 MB, about 9 MB compressed) and the speech runtime are served by LocalRun itself, not a third party. Media tools fetch FFmpeg on the first audio or video conversion, never when the page opens, and the download can be cancelled.

Downloaded models and language data are kept in browser caches so later runs, and offline use, do not download them again. They contain no user data. The browser may evict them, in which case they are fetched again on next use.

What the site is allowed to connect to

The production Content Security Policy lets the page connect only to LocalRun itself, in-memory blob: URLs, and these first-use download origins:

• huggingface.co (speech models)
• *.huggingface.co (Hugging Face model files)
• *.hf.co (Hugging Face's storage redirect)
• cdn.jsdelivr.net/npm/@tesseract.js-data/ (OCR language data, that path only)
• staticimgly.com (background-removal model)

Links that leave LocalRun, such as the Ko-fi support link, are governed by the destination site's policy. LocalRun never adds tool data to them.

Browser permissions

Your browser shows every chooser and permission prompt. Transcribe audio reads an audio file you select and does not use the microphone.

What is saved on this device

LocalRun keeps small preferences in this browser's local storage. Nothing in it is sent anywhere:

• recently used tools and local usage counts, for quick suggestions;
• the emergency privacy-mode setting;
• password-generator settings and an image-quality preference;
• invoice sender details you chose to save;
• your light or dark theme choice, when it differs from the system;
• recently picked emoji.

The service worker and browser caches also keep the app's code, WebAssembly engines and any downloaded models, for speed and offline use. Files shared to the installed app from the system share sheet are held in a cache only until the home page reads them, then deleted. Settings & local data lists and wipes everything LocalRun stored, and can back up or restore your preferences.

Settings & local data

Spellcheck and browser extensions

LocalRun cannot see or block what your browser or an extension does with text on the page. Some cloud spellcheckers and writing extensions send the text of focused fields to their provider. Fields for passwords, keys, text to encrypt or hash, and settings backups opt out of spellcheck, autocorrect and the major grammar extensions; extensions that ignore those signals can still read them. For sensitive text, turn off cloud spelling and writing extensions or use a browser profile without them.

What leaves with your files

• Rename & zip files can add a manifest.json listing each file's name in the ZIP, its size and SHA-256. Original file names are included only if you tick that option.
• Encrypt text output is AES-256-GCM with a 600,000-iteration PBKDF2 key, a random salt and IV, and an authenticated header. It contains nothing else.
• A checksum match in Hash & verify files proves the file matches the value you supplied, not who published it.

Security headers

Every page is served with headers that isolate it for shared-memory WebAssembly (COOP/COEP), block framing and plugins, restrict scripts, styles, images, media, workers and connections to the origins above, prevent form submission, and limit browser capabilities to what the tools use.

The script policy still allows 'unsafe-eval' because the HEIC converter's decoder needs it. Replacing that decoder is the prerequisite for removing it.

No server-side retention

Netlify serves prebuilt files. There is no LocalRun database, session service, API, upload endpoint or server-side processing in which your content could be kept.