Privacy by architecture

Local spreadsheet processing

The downloadable package is a static website. It has no file-upload API, no account system, no analytics SDK, and no telemetry endpoint.

Open the local tool Inspect the method

What happens when a file is selected

The browser grants this page access only to the file chosen through the picker or drag-and-drop action.
JavaScript reads the bytes into memory in the active tab.
Format sniffing, hashing, decompression, XML/text parsing, matching, review, and output generation happen in that tab.
Generated bytes are exposed through a local Blob URL and downloaded by the browser.
Resetting or closing the tab releases the application’s in-memory references; normal browser memory reclamation applies.

Network behavior

All scripts, styles, icons, and bundled reference records are same-origin exif.tools assets. Processing a selected file does not require a request. The existing site service worker may cache static assets for reuse. The tool contains no analytics or advertising code of its own.

Deployment responsibility: a hosting provider, reverse proxy, or separately added analytics script may create ordinary web-server logs or network requests. Those are outside the bundled application and should be disclosed by the operator.

Macro-enabled files

The application never runs VBA. In a supported unsigned XLSM package, macro-related members are treated as opaque ZIP entries and copied to the output. Their uncompressed bytes are compared after generation. Users should still apply their organization’s normal malware-scanning and macro-security policies to source and output files.

Reference-data files

A complete HGNC TSV or JSON reference can be loaded from the user’s device. It follows the same local path as the spreadsheet and is not transmitted by this app. The application stores the parsed reference only in the current JavaScript runtime; it is not written to IndexedDB or localStorage.

Offline cache

The exif.tools service worker can cache same-origin application assets. It does not cache selected spreadsheet files or generated output. Removing the site’s stored data through browser settings clears that static cache.

Security headers

The exif.tools Worker applies a restrictive content security policy, disables framing, limits referrer information, and denies unrelated browser capabilities for these routes.