Verify

Do not take our word for it.

Every page here says nothing is uploaded. This page is how you check that yourself, in about a minute, without trusting anybody.

The one minute version

1

Open the network tab

Press F12, or Command-Option-I on a Mac, and choose Network. Tick "Preserve log" so nothing disappears on you.
2

Go and use a tool with a real file

Open SEAL or X-RAY and give it a document big enough that an upload would be obvious.
3

Sort by size and look at what left

The page, the stylesheet and the scripts come down. Your document does not go up. Filter to Fetch/XHR and what you will find there is this site’s page count: a POST to /api/hit when the page opens, another for a step such as opening a file, and on some visits one to three more as you leave, rating how fast the page was. Click any of them and read the payload. Each is about sixty bytes and holds three things: the page’s address, what happened, and where you came from as a word such as “google” or “none”. It is not sent at all if your browser has Global Privacy Control or Do Not Track switched on. The privacy page lists everything it can say.
4

Hold the site’s own list to the browser’s

Press Private · verify at the foot of the page, or in the corner of an application. It lists every request the page has made since it loaded, what each was for (this site’s files, the paid applications’ code, the key check, the page count) and how many bytes it carried out, and for each file you opened, whether anything has been sent since. Put it beside the Network tab: every line in one should be in the other, with the same address. Where they disagree, believe the browser, and tell us.

The list is kept by this site’s own script, so it is a convenience, not the proof. It cannot see a request made by a worker the page started (the Network tab shows those, marked with a cog), and it marks as “not seen” any request it did not watch go out, rather than guessing what it carried. A paid application’s receipt adds what the site’s service worker saw, which includes those workers.
5

Then pull the plug

Load the tool, turn off your wifi, and use it anyway. It works, because everything it needs is already in the tab.

What the browser enforces, whatever we say

These are sent as headers on every response and enforced by your browser, not by us.

connect-src 'self'

The page is only permitted to make network requests back to obscuraos.com. If a script here tried to send your document to any other domain, the browser would block the request and log a violation. This is the important one, and it is worth being precise about what it does not cover: it still permits a request back to this site's own origin. That part is what the network tab check above is for.

camera=(self), microphone=(self), geolocation=(self)

Camera, microphone and location are the only device features the site can ask for, and only for this site itself: nothing embedded in a page can ask, and payment, USB, serial and Bluetooth are switched off outright, so the browser will refuse those on your behalf even if a future version of the code tried. The three that are allowed are used by a handful of tools, only when you press the button, and always through your browser’s own permission prompt: the camera to read a code off a screen in AIRGAP, take a picture in SNAP or record in REEL; the microphone for a voice-over in REEL; your location for CORDON’s “where am I standing”, SNAP’s place stamp and the start of a trip in MILEAGE. What they read stays in the tab.

form-action 'self'

A form on this site cannot submit anywhere except back to this site. There is no way to post what you typed to a third party, including by accident.

object-src 'none', base-uri 'self'

No plugins, and the page cannot rewrite the base address that relative links resolve against, which is a common way injected code redirects requests elsewhere.

default-src 'self'

Scripts, styles, fonts and images all have to come from this origin, with one exception the policy names: Cloudflare Web Analytics, which is switched on for this site, so a script from static.cloudflareinsights.com loads on each page and reports that the page was viewed. Nothing in the site's own code loads it, and nothing you open or type in a tool is in any request for it to report. There is no tag manager and no advertising code. The privacy page says what the script reports, and this policy lists it as the only outside host allowed.

Check the code you were served

A SHA-256 of the files your browser just received from this site, right now, on your machine, each held to the release record: releases.json, which the build writes with the SHA-256 of every file the site serves, the paid applications’ code under /pro-code/ included.

A script or stylesheet should match its line exactly. A page is not compared: the host adds Cloudflare’s analytics script to each page as it sends it, so a page you were served is never byte for byte the file in the record. Any file you saved from the Network tab, a paid application’s code among them, can be held to the record the same way with sha256sum, or certutil -hashfile on Windows.

The record can be signed, so that somebody who changed the files on the host could not also change the record to match. Checking a release gives the commands, for a terminal with Python 3 and OpenSSL 3.

Check a receipt or a redaction certificate

Each paid application can save a receipt: a signed account, from the browser it ran in, of the files a session opened and saved, with their SHA-256, and every request the page and the site’s service worker saw, workers included. PDF Studio and Case can also sign a redaction certificate: the redacted file read again from its bytes, and none of the redacted words found in it, and Sound can seal a recording as it is made: each second hashed and chained as it came in. Drop any of them here, then the recording itself to check it against its record. It is checked in this tab and sent nowhere; for a receipt, the release record above is read to compare the code it ran.

Drop a receipt or a certificate here

Choose a file The device fingerprint you expect, if you know it

A receipt is the device’s own testimony. Its signature shows it was not changed after it was signed; it cannot show what a modified browser or an extension did, and it does not cover requests the browser makes for itself.

If you find something wrong

Write to Hello@ObscuraOS.com.

None of this is a certification and there has been no third-party audit. It is evidence you can gather yourself.