Skip to content
Security & privacy

Built so there's nothing to leak.

Every tool on this site processes your files entirely in your browser. Not “we delete it after” — it never leaves your machine in the first place. Here's exactly how, so you or your IT team don't have to take our word for it.

Zero data storage, by architecture. None of the four practitioner tools make a single network request that carries the content of what you paste or open.

01How the tools actually work

When you paste text or open a file, JavaScript running in your browser reads it directly using the File Reader API — a standard browser capability, the same one your email client uses to attach a photo. That JavaScript parses, diffs, or builds the reference graph entirely on your own device's processor. There is no server-side code that receives, sees, or processes the content of what you paste or open — because there is no server-side code involved in tool usage at all. The whole site is static pages plus client-side JavaScript.

02Verify it yourself

This is the part that matters — don't take our word for it.

01
Open any tool

Delta, Ledger, Root, or the Hierarchy Converter — any of them.

02
Open your browser's DevTools

F12 on Windows/Linux, or Cmd+Option+I on Mac, then switch to the Network tab.

03
Paste or open a file, use the tool normally

Run a comparison, build a graph, load a hierarchy — whatever the tool does.

04
Watch the Network tab

Zero outbound requests will carry what you pasted or opened. That's not a promise — it's something you're watching happen.

This holds up in any browser, on any network. It isn't something we can quietly change without you noticing — it's observable in real time, every time.

03What we don't do
  • No accounts, no sign-in, no passwords to manage
  • No cookies, no analytics, no tracking pixels of any kind
  • No localStorage or sessionStorage retaining what you paste or open
  • No backend server or database that ever receives file content
  • No file uploads — “Open file” reads locally via your browser's File API
04Every external connection this site makes

For IT teams building an allowlist — the complete list, nothing omitted:

This site
Static pages, served over HTTPS — the page you're reading now.
Fonts
Bundled into the site at build time (self-hosted). No runtime request to Google Fonts or any font CDN.
Buttondown (buttondown.com)
Only if you submit the newsletter signup form on the Newsletter page.
Formspree (formspree.io)
Only if you submit a “Suggest an edit” or tool-request form.

The last two are opt-in, unrelated to the tools themselves, and only fire on the specific pages where you'd expect a form to submit somewhere.

05For IT & security reviewers
  • No installation. This is a website, not a browser extension or desktop app — nothing to install, nothing to uninstall, no elevated permissions requested.
  • No data processing agreement needed. File content is never transmitted to or processed by any server we control, so there's no vendor-processing relationship to govern under GDPR/CCPA for tool usage.
  • Minimal dependency footprint. The entire site runs on Next.js, React, and one small diffing library — no analytics SDKs, no third-party JavaScript beyond what's listed above.

The source itself is proprietary, but the architecture described here is exactly what ships — verify it with the steps above rather than relying on this page alone.

Questions for a security review?

Last reviewed July 2026