How Privacy Works

A technical explanation of Maskr's client-side architecture.

The Core Principle: No Server Uploads

Every Maskr tool processes files entirely in your web browser. When you select an image or PDF, it's loaded into browser memory using the File API. Processing happens using JavaScript, WebAssembly, and the Canvas API. The result is downloaded directly from your browser. At no point do your files touch our servers.

Technology Stack by Tool

Face Detection

@vladmandic/face-api (TensorFlow.js)

Neural network runs in your browser using WebGL acceleration. Model files (~6MB) are downloaded once and cached. No faces are ever sent to any server.

OCR Text Detection

Tesseract.js v7

OCR engine runs in a Web Worker thread. Language models are downloaded and cached locally. Text recognition happens entirely in your browser.

PDF Processing

pdf-lib + PDF.js + MuPDF (WASM)

PDFs are parsed and rendered using a self-hosted PDF.js worker. Redaction flattens pages to PNG images, permanently destroying underlying text streams.

Image Processing

Canvas API + piexif + ExifReader

Images are processed using the browser's native Canvas API. Metadata is stripped by re-encoding (PNG/WebP) or using piexif for lossless JPEG EXIF removal.

Text Masking

Native JavaScript RegExp

Pattern matching runs entirely in JavaScript. Your text never leaves the browser. Regex patterns are hardened against ReDoS attacks.

What Network Activity Occurs?

You can verify Maskr's privacy claims using your browser's Developer Tools (Network tab). Here's what you'll see:

On Page Load:

HTML, CSS, and JavaScript bundles from maskr.app
Font files from maskr.app (self-hosted, not Google Fonts)
ML model files from maskr.app/models/ (for face detection)

If You Accept Analytics:

One request to plausible.io (page view, no cookies)

If You Accept Ads:

Requests to googlesyndication.com (ad scripts and content)
These scripts may set cookies and track browsing

When Processing Files:

Zero network requests. No data leaves your browser.
The download is a blob URL created locally, not a server download.

Verify It Yourself

Don't take our word for it. Here's how to verify:

Network Tab: Open DevTools (F12), go to Network tab, filter by "Fetch/XHR". Process a file. You'll see zero requests during processing.
Offline Mode: Disconnect from the internet after the page loads. All tools will still work (except downloading ML models on first use).
Source Code: View page source or inspect our JavaScript bundles. Search for fetch( calls - you'll find none that upload user files.
Firewall Test: Block all outbound connections except maskr.app. Tools continue to function normally.

Why Client-Side Matters

Most "free" online tools process your files on their servers. This means:

Your files are transmitted over the internet (even with HTTPS, they see the content)
Files may be logged, cached, or stored temporarily
Server operators could potentially access your data
Data breaches could expose your sensitive files

With Maskr, none of this applies. Your browser is the processing engine. We never see your files because they never leave your device.