How it works

The short version: there is no server to trust, because there is nothing for a server to do.

Where the questions live

Everything after the # in a web address is handled by your browser and is never included in the request it sends. So the questions in your link reach the page without ever reaching us. Our logs can show that somebody loaded the page. They cannot show what was in it.

Where the answers live

In the page you are typing into, and nowhere else. The answering page is sent with a rule attached — a Content-Security-Policy — that forbids it from making any network request at all. No uploads, no analytics, no fonts fetched from somewhere else, no error reporting. Not as a promise: the browser enforces it.

The PDF is assembled in your browser. When you send it, you send it yourself, through whatever app you already use. We are not in the middle.

What that does not cover

We would rather say this plainly than be caught having implied otherwise.

The rule stops the page making requests. It cannot stop the page navigating. There is no browser mechanism that prevents a page sending you somewhere else with information in the address. So the honest claim is not that leaking is impossible — it is that leaking cannot be silent. Anything leaving this page has to take your browser with it, in front of you.

You are trusting the code we send you today. Every site that says it protects you has this problem: the people making the promise are the people sending the code that keeps it. What we can offer is that the code is public, the site is static, and the rules above are visible in your own browser on every single load. That makes a betrayal detectable. It does not make it impossible, and anyone telling you otherwise is selling something.

The company that serves this site adds something of its own. Cloudflare, which hosts it, tells your browser to report network failures — a dropped connection, a DNS error — to an address of theirs. It happens only when something goes wrong, it carries no part of the questions or the answers, and it comes from your browser rather than from this page, so the rule above does not govern it. We would rather it were not there and cannot currently remove it. It is the plainest example of the point above: the site is served by somebody, and being served by somebody has consequences you do not get to switch off.

Your own device may not be as quiet as this page. Some browsers offer an “enhanced spellcheck” that sends what you type to Google or Microsoft. We switch spellcheck off on the answer boxes for that reason. Extensions can read any page. Keyboards on phones learn what you type. Your browser may sync its history — including the link, and so the questions — to your account. Your answers never go into a web address, so they never travel that way. None of the rest is something a website can fix, and you should know about it.

What we keep

Nothing. There is no account, no cookie, no analytics and no database, so there is no cookie banner either. The only record that you were here is whatever our host writes in its access log: an address, a time, and the page you asked for. Never a fragment, and never an answer.

Links do not last forever

Every link carries an expiry date, and stops working after it. That is deliberate: a link that works for ever is a link that still works long after anyone involved has stopped thinking about it.