Your trace
When you open a HAR file, your browser reads it into memory and Snifflab
parses it there. Snifflab never uploads it and never writes it anywhere.
Close the tab and it is gone. Redaction and decoding happen in the same
place, so a redacted copy was produced on your machine and did not travel
anywhere first. The only file that ever leaves this tab is one that you
deliberately save.
What is recorded
Nothing. Snifflab sets no cookies, writes nothing to local storage, and has
no analytics, no error reporting and no telemetry of any kind. There is no
third-party script, font or image on this page. The fonts are embedded in
the file you are already reading.
Why this is not simply a promise
The page ships connect-src 'none' in its Content-Security-Policy,
which makes fetch, XHR, WebSocket, EventSource and
sendBeacon fail at the browser level.
form-action 'none' blocks form submission as a way out. This is
not a policy that we follow. It is a permission that the page does not have.
You can confirm it in about ten seconds. Open your browser's Network tab,
load a trace, and watch it stay empty. The policy itself is in the
<head> of this page, and the source is public.
If you would rather not trust the network at all, save this page to disk and
open it from file://. It behaves identically, because
everything it needs is already in the file.
The website
snifflab.dev is served as a static file by Cloudflare Pages. Like any web
server, it sees the request for the page itself, including your IP address
and the user agent your browser sends. That request is the only contact your
browser makes with us, and it happens before you have opened anything.
Whatever you do afterwards is not part of it.
Links
One link leaves this page, and it goes to Flytrap Industries. It opens in a
new tab so that a loaded trace is not discarded, it carries no query string,
and it sends no referrer, so the destination is not told where you came
from. The build refuses to produce a file where that is untrue.
Changes
If any of this changes, it changes in this file, and this file is the
product. There is no policy hosted elsewhere that could quietly say
something different from the page you are holding.