What is sent, and what is not
Every host this site talks to, and what each request carries. It is written so that you can decide whether the site is usable where uploading to an outside service is not allowed — from facts rather than from our reassurance.
Data used by local processing
Local audio, image and PDF operations are designed to process the following data inside the browser. Network features send inputs according to their purpose; the entire site is not network-free. See the table for each service and its purpose.
- Audio and video files, and the results of separating or converting them
- Image files, including the capture date, camera model and GPS position inside them
- PDFs and the text inside them
- Text you paste into a field (address lists, JSON, API responses)
- File names
- Microphone audio (tuner, voice recorder)
Examples of features that send input
- The domain you type into DNS Lookup goes to Cloudflare’s public DNS (cloudflare-dns.com). The names live out there, so there is no way to resolve one without sending it. Note that an internal-only hostname would leave your network.
- Device-to-device transfer sends file contents directly to the device you select, not to the connection service. The connection service receives SDP and ICE candidates, the connection code, device display name, type and identifier; it also receives the connecting IP address. Connection codes are excluded from site analytics.
- Submitting a game ranking sends the name you enter and your move sequence. This is separate from local processing.
Stored data and removal
- Files saved to the bench, and files received through the OS Open with or sharing actions, are stored with their names in the browser’s origin-private file system (OPFS). They remain after the tab closes. Shared files also temporarily pass through a browser share-inbox cache.
- Tool history and appearance settings are stored in the browser. Tool history records page paths, not input or filenames. Separation model weights and supplied demos may also be cached on the device for reuse.
- Use Delete saved bench data in Settings to remove bench files. This does not clear the share-inbox or model caches. Your browser’s site-data controls also cover history, settings, stored files, the share inbox and model caches. Exported files in your download destination are separate and are not deleted by this site.
What the site supplies to analytics
The site supplies page and feature usage, completion or failure categories, and duration or size ranges. It does not supply filenames, exception text, exact track durations or byte counts. Analytics URLs exclude connection codes, unknown query parameters and fragments; campaign parameters such as utm_* and gclid are retained. See the communication table and Privacy Policy for advertising services and cookies.
Observed processing behavior
On October 21, 2026, we exercised four operations in a local production build in Edge on Windows: MD5 hashing, PDF page reorder/rotation/export, PNG exposure adjustment/export, and ZIP creation from two same-named files. Outputs were verified. Both original files were retained in the ZIP and matched byte for byte.
From ready controls through selection and download, no non-GET HTTP request attempts or WebSocket connections were observed. Synthetic input markers were not detected in request URLs, bodies or headers.
Page and Worker upload probes, plus real WebSocket connections on the same computer, first confirmed that the observer could detect them.
Analytics were excluded by hostname and service workers were disabled. Unexpected HTTP request attempts were blocked during the test. This does not establish the behavior of production advertising/analytics scripts, every format or every device. Page-load communication and retained device data are separate checks.
Hosts the page does contact
These are the services used by the page and network features, the data they receive and when communication occurs. Network-feature inputs and files sent to a recipient are transmitted. The previous section distinguishes data supplied to analytics.
| Host | Purpose | When it happens |
|---|---|---|
pagead2.googlesyndication.com / googleads.g.doubleclick.net | Ads (Google AdSense). This is what pays for running the site. | Always. Uses cookies. |
www.googletagmanager.com | Analytics (Google Analytics 4) — which pages get used. | Only when an analytics ID is configured. Uses cookies. |
/_vercel/insights | Page-view counting (Vercel Analytics). Same domain as the site. | Always. |
fonts.googleapis.com / fonts.gstatic.com | The Japanese typefaces (Noto Sans JP and Noto Serif JP) — fetched so the text looks the same on every device. | On the first visit; after that the stored face is reused. Not on devices that already ship Noto Sans CJK JP (most Android devices). |
huggingface.co | The AI separation model weights. Once fetched they are stored on the device and not requested again. | Only when you run a separation. |
raw.githubusercontent.com | Downloads the AudioSep lead separation model. No audio is sent. Successfully stored models are reused. | When running lead/backing separation without a valid model cached on the device. |
www.jma.go.jp / www.data.jma.go.jp | Weather forecasts and earthquake reports (Japan Meteorological Agency open data). Only which region or list you viewed is sent. It does not pass through this site’s server. | On opening the weather tool. The earthquake tool checks for new reports every 90 seconds while it is open (it stops when the tab is hidden), and fetches the past list only when you press load. |
speed.cloudflare.com | Runs the connection speed test. Only filler data is exchanged to time the transfer — no files and no input. It does not pass through this site’s server. | Only when you press Measure in the speed test. Up to 21MB down and 6MB up per run. |
cloudflare-dns.com | DNS-over-HTTPS queries for the DNS lookup tool. The domain you type is sent there. It does not pass through this site’s server. | Only when you press Look up in the DNS lookup tool. |
/api/ip | Powers the IP address check. Same domain as the site; no third-party IP service is involved. The address is used to build the response and is not stored. | Only when the IP address check page is open. |
stun.l.google.com | STUN for NAT traversal (WebRTC) — asking what your address looks like from outside. Your public IP is visible to that Google server while this happens. No file data passes through it. | Only while a device-to-device transfer is establishing a connection. |
stemstudio-beam.stemstudio-jp.workers.dev (our server) | Two uses. First, device-to-device transfer: SDP and ICE candidates, the connection code, device display name, type and identifier. The connecting IP address also reaches this service. File contents travel directly between devices, not through this service. Second, submitting a result to a game ranking: your name and move sequence; the move count is recomputed on the other end. | When you use device-to-device transfer, and when you press Submit on a game ranking yourself. |
nzf358i1c3wxy8sd.public.blob.vercel-storage.com (Vercel Blob — our distribution store) | The desktop installer (.msi) itself. Only a file we send you; none of your files or input goes there. | Only when you open the desktop download page (which starts the download as soon as it opens). The audio, image and PDF tools never talk to it. |
How to check for yourself
You do not have to take our word for it. Either of these settles it.
- Use a tool with the network tab open. The requests in the table above appear; no file upload does.
- For local-processing tools, load the needed code, formats and models before disconnecting and trying the same operation. New formats/models and network features such as DNS, weather and transfer need a connection. This is not a guarantee that every feature works offline.
Limits worth stating
- Ads and analytics use cookies and pass information to Google services. Where that is unacceptable, blocking those domains with an extension or a corporate filter does not affect how the tools work — you simply see no ads.
- This site is run by one person. There is no SLA and no audit report. What you have to go on is the table above and the behaviour you can verify yourself.
- Device-to-device transfer is the one tool that does send a file to another device. It differs in kind from the rest; treat it separately.
For personal data, see theprivacy policy.