Trust claims should be testable. You can inspect the Network panel, run the privacy build audit, and run the no-network processing test against representative workflows.
Short answer
Open DevTools before selecting a file, clear the Network log, run the tool, and confirm processing does not create third-party or upload requests. For repository verification, run npm run verify:privacy.
Build boundary
Verification path
Use the verification page, browser DevTools, and repository privacy tests to inspect the behavior instead of relying on marketing language.
Browser DevTools check
Open a clean browser profile: Use privacy.convertunlimited.com and disable browser extensions if possible, since extensions can add their own requests.
Open Network panel: Enable Preserve log and disable cache, then filter by All so short-lived requests are not hidden by a narrower filter.
Load the page, then clear the log: Let the initial HTML, CSS, JS, and vendored library requests finish, then click the clear icon so only what happens next is visible.
Process a sample file: Select a file, run the tool, and watch for any new entry appearing in the list while processing runs.
Review each new request: Click any new row and check its Initiator tab. Expected entries are same-origin static assets, data: URLs, or blob: URLs; a third-party host, an analytics beacon, or anything resembling an upload should not appear.
What appears on the public build
Google Tag Manager: www.googletagmanager.com/gtm.js, container GTM-KQHC5ZGV, loaded on every page.
AdSense loader: pagead2.googlesyndication.com, script query parameter client=ca-pub-2823470980745945, loaded on the homepage.
Google Fonts: fonts.googleapis.com/css2?family=Inter... and the fonts.gstatic.com font files it references.
Per-tool CDN libraries: for example cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js on the homepage, or unpkg.com/pdf-lib@1.17.1/dist/pdf-lib.min.js on the merge, split, and compress PDF tools.
What appears on the privacy build
The same tool pages load the same libraries, but from same-origin paths such as /vendor/jszip-3.10.1.min.js and /vendor/pdf-lib-1.17.1.min.js instead of a CDN host. No Google Tag Manager, AdSense, or Google Fonts request should appear.
Because the privacy build's CSP sets connect-src 'none', fetch, XHR, WebSocket, EventSource, and sendBeacon calls should fail in a supporting browser after the page has loaded, independent of what the Network panel shows.
In DevTools, open the Network panel, click the top-level document request (the HTML page itself), open its Headers tab, and read the content-security-policy entry under Response Headers. It should match the string above exactly.
From a terminal, curl -sI https://privacy.convertunlimited.com/ prints the same response headers, including content-security-policy, referrer-policy, and permissions-policy, without loading a browser.
Repository checks
The repository includes static and runtime checks for the privacy artifact. The static audit scans for known third-party runtime references. The runtime test blocks common network APIs while exercising representative processing flows.
npm run build:privacy
npm run audit:privacy
npm run test:privacy-network
npm run verify:privacy
What the runtime test actually does
Serve the artifact: tests/no-network-processing.js starts a plain Node HTTP server for dist/privacy-build/ on port 4187 by default (overridable with a PORT environment variable), setting the same CSP on every response it serves.
Launch headless Chrome: It spawns Chrome with --headless=new and a remote debugging port of 9233, connecting over the Chrome DevTools Protocol; the Chrome binary path is overridable with a CHROME environment variable.
Patch network APIs: Inside the page, window.fetch, XMLHttpRequest.prototype.open, and navigator.sendBeacon are replaced with functions that record the call and throw, so any attempted network call surfaces as a JavaScript error rather than a silent success.
Build a test file: A 1x1 PNG is decoded from a hardcoded base64 string into a File object and wrapped in a DataTransfer, so it can be assigned to a real file input without a filesystem dependency.
Exercise three flows: the homepage image converter (#file-input, then #primary-btn), the metadata remover (#remover-file-input, then #remove-all-btn), and the background remover (#bg-file-input, then #bg-process-btn).
Fail on any violation: the script throws if a patched network function was called, if the page threw an exception, or if any request during processing went to a host other than 127.0.0.1 and was not a data: or blob: URL.
Related proof page
The existing proof page summarizes the privacy artifact, verification command, network isolation model, and threat-model limitations.
Does a clean Network panel prove all security properties?
No. It verifies a narrow behavior: whether the tested processing flow caused network requests.
Can browser extensions affect the result?
Yes. Extensions can inject scripts or inspect page data depending on their permissions.
What does npm run audit:privacy check that a manual DevTools pass cannot?
It scans every generated file for a fixed list of disallowed hostnames and phrases, including hosts that might only load conditionally and never appear during one manual test run.
Does the runtime test cover every tool?
No. It exercises three representative flows: the homepage image converter, the metadata remover, and the background remover. Other tools follow the same architecture described in Local processing but are not individually scripted in this test.
Can I change the ports the test uses?
Yes. Set PORT for the local HTTP server (default 4187) and CHROME for the Chrome binary path; the CDP debugging port is fixed at 9233 in the script.
Review note
Trust documentation reviewed: May 2026. These pages describe the current public and privacy-build architecture and should be updated when deployment, telemetry, or runtime dependencies change.