Privacy proof

Don't take our word — open DevTools and check

This page turns "your input never leaves the tab" into four criteria you can verify right now. Everything below describes the current build; if it ever stops matching, we got it wrong — please tell us.

How to check

1Press F12, open the Network panel and tick Preserve log.
2Keep the panel open, go back to the home page, open a few tools, paste something and press generate.
3Compare the request list against the four criteria below. No proxy or packet capture needed.

(async () => {
  const sw = (await navigator.serviceWorker?.getRegistrations?.()) ?? [];
  console.log("service workers:", sw.length);
  console.log("resources:", performance.getEntriesByType("resource")
    .map((r) => new URL(r.name).host).filter((h, i, a) => a.indexOf(h) === i));
})();

Every outbound request this site makes

We do not claim "zero requests" — that would be false. This is the complete list, and each entry states its trigger: without the trigger, it does not happen.

Same origin
/_vercel/insights/*
On any page load — injects the same-origin analytics script and reports a page view; using a tool reports one usage event (first-party aggregate, no cookies, no fingerprinting, never any input content)
Third party
va.vercel-scripts.com（仅开发环境）
In development the analytics script comes from va.vercel-scripts.com; production builds use the same-origin path above. What you see in Network should be the same-origin one
Same origin
POST /api/tools/request-info
Only when you press the button in Request Info (headers are read server-side and discarded — not stored, not logged)
Third party
huggingface.co
Only when you actively use Video to Prompt and the model loads for the first time (weights far exceed the bundle budget, so they are fetched on demand; a 1-byte probe first decides between direct access and the same-origin `/hf` proxy)
Third party
cdn.jsdelivr.net
Same moment, only on first use of that tool — transformers.js fetches the onnxruntime-web WebAssembly runtime from jsDelivr by default (a code asset, browser-cached and not downloaded again)
Same origin
/api/bazi-story
Only when you press "Write one with AI" in the BaZi tool — a summary (birth time + four pillars + ten gods + luck pillars) is POSTed to this site's function, which forwards it to the model; nothing is stored or logged, and a refresh leaves no trace
Third party
api.cloudflare.com
At that same moment the server-side function forwards the summary to Cloudflare Workers AI (the free-quota channel). This happens on the server and is invisible in your browser's Network panel; the token lives only in server env vars and is never shipped to the client
Third party
用户自选的服务商（BYOK）
If you bring your own API key in the story panel, the request goes from your browser straight to the provider you chose (DeepSeek / Groq / OpenRouter …) — this site never relays it, and the key stays in this device's localStorage

The four criteria

XHR / Fetch

Where to look: Network panel → filter Fetch/XHR
What you should see: Nothing beyond the entries listed above. Opening any tool, pasting content and pressing generate will not add a request.

sendBeacon

Where to look: Search `sendBeacon` globally in the Sources panel, or break on `navigator.sendBeacon` in the Console
What you should see: Zero hits in site code — our bundle contains no sendBeacon call. The only place it can appear is the same-origin analytics script /_vercel/insights/script.js (Vercel's, not our code); every report it makes shows up in the Network panel, it cannot hide.

Service Worker

Where to look: Application panel → Service Workers
What you should see: This version registers no service worker — the list stays empty. There is no offline cache either, so no background script can go online for you.

Third-party domains

Where to look: Network panel → group by Domain, or read the domain column in the waterfall
What you should see: Only this site's domain (plus the single CDN named in the list). No ad scripts, no font CDN, no social widgets.

Which tools never send your input anywhere

Tools come in two kinds: local ones compute inside the browser and your input never reaches a server; server-side ones hand the input over once. The split comes from a `runtime` field in the code, not from a claim.

Runs in your browser (26)

Server-side (1)

request-info

The only server-side tool is Request Info — it must read headers on the server to tell you the truth. The input is used for that single response only: not stored, not logged.

Local storage

The site writes exactly four things into your browser. All are visible under Application → Local Storage and can be cleared at any time:

ft-themelight / dark preference
ft-favorite-toolsslugs of tools you starred, at most 24
ft-recent-toolsrecently opened tool slugs, at most 6
ft-bazi-llmyour own model API key (only present if you chose "use my own key")

No cookies, no cross-site identifiers, no cross-device sync. Clearing browser data removes all of it.

Page views and tool-use events are counted with Vercel Web Analytics: no cookies, no fingerprinting, no input content, and never shared with ad networks.

Still want to confirm? Read the source Back to all tools