Check it yourself

How the tools work

When you choose a file, the tool reads it inside the page and processes it with code running on your device, often compiled to WebAssembly. The result is created in your browser and saved straight to your downloads. The file is never sent to a server.

The same checks work on any other site that handles files.

• How to check any website for uploads

Read the Content Security Policy

Every page on eolietech.com is sent with a Content-Security-Policy header: a set of rules your browser enforces on the page, whatever the page's own code tries to do. For your files, the rule that matters is this one:

connect-src 'self'

It means scripts on the page can only open network connections (fetch, XHR, WebSockets, beacons) to eolietech.com itself. If any code tried to send data to another server, the browser would block the request and log an error in the console.

To be precise: 'self' still allows connections to eolietech.com. The only server endpoint on the site is the Pro waitlist sign-up, which accepts an email address. The network test below shows that the tools don't call it, or anything else, with your files.

To see the header, open your browser's developer tools (F12, or Cmd+Option+I on a Mac), select the Network tab, reload the page, select the first request and find content-security-policy under Response Headers. From a terminal:

curl -sI https://eolietech.com/ | grep -i content-security-policy

The full policy, as served today:

default-src 'self';
connect-src 'self';
script-src 'self' 'wasm-unsafe-eval' https://challenges.cloudflare.com;
frame-src https://challenges.cloudflare.com;
worker-src 'self' blob:;
img-src 'self' data: blob:;
media-src 'self' blob:;
style-src 'self';
object-src 'none';
base-uri 'self';
form-action 'self';
frame-ancestors 'none'

What the other rules do:

• script-src: code can only come from eolietech.com, plus Cloudflare Turnstile for the waitlist spam check. 'wasm-unsafe-eval' lets the tools run WebAssembly.
• worker-src: the background workers that do the heavy lifting must come from eolietech.com.
• img-src and media-src: images and audio can only come from the site itself, or from data: and blob: URLs, which hold your own files in memory.
• frame-src: the Turnstile check is the only thing that can be embedded.
• form-action: forms can only submit to eolietech.com.

Watch the Network panel

1. Open a tool page, then open developer tools (F12, or Cmd+Option+I on a Mac).
2. Select the Network tab and clear the list.
3. Process a file.
4. Look at the requests. The first time you use a tool you may see its code, WebAssembly modules or an AI model being downloaded from eolietech.com. Those are downloads to you. Nothing is uploaded, and nothing goes to any other domain.

Select a request and open its Payload tab to see what it sent. Code downloads send nothing.

Go offline

1. Open a tool and process one file, so everything the tool needs has loaded.
2. Disconnect: turn on airplane mode, or choose Offline in the Network tab's throttling menu.
3. Process another file. It still works, because none of the work needs a server.

Read the code

Eolietech is open source under the GNU Affero General Public License v3.0. The source repository holds the code of every tool and the headers file quoted above.

• Source code
• The AGPL-3.0 licence

What we never do

• Upload the files you open in a tool.
• Show ads or load advertising scripts.
• Sell or share data about you.
• Ask for an account to use the free tools.

What other parties can see

The site is hosted on Cloudflare. Like any web host, Cloudflare handles standard request data when you load a page, such as your IP address and the page address. It never receives your files.

The Pro waitlist on the pricing page uses Cloudflare Turnstile to keep out spam sign-ups. It loads on that page only.