Privacy-First Architecture

​

Zero Server Transmission

​

Client-Side Processing Architecture

​

Static Export Benefits

• No Server Runtime: The application consists only of HTML, CSS, and JavaScript files served as static assets
• No Backend APIs: There are no server-side API routes that could receive or process your data
• No Database Connections: The application does not connect to any remote databases or storage services
• No Analytics Tracking: No user behavior tracking, session recording, or third-party analytics scripts

// Next.js configuration enforcing static export
/** @type {import('next').NextConfig} */
const nextConfig = {
  output: 'export',  // Forces fully static build
  images: {
    unoptimized: true  // No image optimization server
  }
}

​

Local State Management

​

IndexedDB for Tool History

// lib/db.ts - Local database schema
import Dexie, { type EntityTable } from 'dexie'

export const db = new Dexie('KaystonsForgeDB') as Dexie & {
  history: EntityTable<HistoryEntry, 'id'>
  favorites: EntityTable<FavoriteEntry, 'id'>
  settings: EntityTable<SettingEntry, 'key'>
}

db.version(1).stores({
  history: '++id, toolId, timestamp',
  favorites: '++id, toolId, timestamp',
  settings: 'key'
})

​

localStorage for UI State

// lib/store.ts - UI state using Zustand
import { create } from 'zustand'
import { persist } from 'zustand/middleware'

export const useAppStore = create(
  persist(
    (set) => ({
      sidebarOpen: true,
      activeTool: 'json-format-validate',
      // ... other UI state
    }),
    {
      name: 'kaystons-forge-ui',
      storage: createJSONStorage(() => localStorage)
    }
  )
)

​

Tool Processing Flow

1. Input: User enters data into the browser textarea
2. Processing: JavaScript engine executes transformation logic locally
3. Output: Result is displayed in the browser and optionally saved to IndexedDB
4. No Network: Zero HTTP requests are made during tool execution

// lib/tools/engine.ts - Synchronous client-side processing
export function processTool(
  toolId: string,
  input: string,
  options?: Record<string, unknown>
): ToolResult {
  // Large switch statement routes to local transformation logic
  switch (toolId) {
    case 'json-format-validate':
      return formatJSON(input, options)
    case 'base64-encode':
      return encodeBase64(input)
    // ... 45 more tools, all client-side
  }
}

​

Progressive Web App Offline Support

// public/sw.js - Service worker for offline caching
self.addEventListener('install', (event) => {
  event.waitUntil(
    caches.open(CACHE_NAME).then((cache) => {
      return cache.addAll(STATIC_ASSETS)
    })
  )
})

• Caches static assets locally for offline use
• Does not transmit any user data
• Runs entirely in your browser’s isolated worker context

​

Privacy Guarantees

​

What We Don’t Collect

• No user accounts or login credentials
• No input data from any tool
• No tool usage analytics or telemetry
• No IP addresses or device fingerprints
• No cookies (except localStorage for UI preferences)
• No third-party scripts or tracking pixels

​

What Stays Local

• All tool inputs and outputs
• Tool execution history (max 50 per tool)
• Favorite tools list
• Application settings and preferences
• Service worker cache

​

Verifying Privacy Claims

​

1. Network Inspection

​

2. Source Code Audit

• lib/tools/engine.ts - All tool processing logic (synchronous, no network calls)
• next.config.js - Static export configuration
• lib/db.ts - IndexedDB schema (local storage only)
• lib/store.ts - Zustand state management (localStorage only)

​

3. Static Build Output

• Static HTML files (one per tool route)
• JavaScript bundles (all tool dependencies bundled)
• CSS stylesheets
• Static assets (fonts, icons, manifest)

​

Comparison to Server-Based Tools

​

Known Trade-Offs

• No cloud sync: Your history and favorites don’t sync across devices
• No collaborative features: No shared workspaces or team tools
• No server-side features: No scheduled tasks, webhooks, or integrations
• No usage analytics: We can’t improve tools based on usage patterns

​

Deployment Architecture

// vercel.json - Static hosting configuration
{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        // Security headers only - no tracking or analytics
      ]
    }
  ]
}

• Serves static assets only
• Applies security headers (see HTTP Security Headers)
• Does not execute any server-side code
• Does not log request payloads

​

Security Implications

​

Attack Surface Reduction

• No server-side vulnerabilities: SQL injection, RCE, SSRF, etc. are impossible
• No credential theft: There are no passwords or API keys to steal
• No data breaches: There is no centralized data store to compromise

​

Client-Side Security Responsibilities

1. Browser security: Use an up-to-date browser with security patches
2. Device security: Your local storage is only as secure as your device
3. Network security: Use HTTPS to prevent MITM attacks on static asset delivery

​

Progressive Enhancement

• Core functionality: Works without JavaScript (static HTML fallback)
• Enhanced functionality: Full tool suite with JavaScript enabled
• PWA features: Install prompt and offline support with service worker

​

Future Privacy Enhancements

• Memory clearing: Explicit tool to securely clear all local data
• Incognito mode: Session-only storage with no persistence
• Export/import: Encrypted backup of history and favorites
• Ephemeral URLs: Share tool outputs via client-side encrypted URLs

​

Conclusion