Verify logos stay on this device

LocalFavicon builds a favicon package (ICO, multi-size PNG, site.webmanifest, HTML snippet) entirely in the browser. This page is the check you can run yourself: which network calls are normal, and which calls would mean your logo left the tab. The generator is on the home page. The short policy is the privacy policy. The usage rules are the terms. Publisher context is on about.

What you are proving

You are proving that generating a favicon package does not upload your image bytes, text-tile settings, or emoji source. You are not proving that nothing on your computer can see the tab. A browser extension, malware, or a recorder you installed can still read a page. This site does not receive those inputs, and it does not claim to block other software on the device. Values never leave this device through this page.

Also remember: a generator does not grant trademark rights. Only process marks you own or are licensed to use. See favicon from PNG/SVG and the terms.

If Network shows a POST or PUT of your image bytes or source payloads, stop using that session and write to contact@localfavicon.pages.dev with the page URL and what you saw — without attaching the real logo. That would not match how this tool is built.

Steps in DevTools

1. Open the generator. Use a throwaway test PNG or short text tile the first time — not an unreleased client mark — until you trust the flow.
2. Open DevTools → Network. In Chrome that panel is documented as the Network panel. In Firefox it is the Network Monitor. Enable “Preserve log” so a reload does not wipe the list.
3. Reload the page once and let the first requests finish. You should see same-origin GETs for the document, /assets/styles.css, /assets/vendor/jszip.min.js, /assets/tool.js, and the favicon.
4. Choose From image and pick a small test file (or switch to text/emoji). Watch for new rows. There should be no POST, PUT, or beacon whose body is your image bytes.
5. Click Generate favicon ZIP on this device and download. The ZIP is built in the tab with JSZip from canvas/ICO blobs; it is not a multipart upload of your logo to our server.
6. Optional: clear the tool and close the tab. In-tab selections, object URLs, and results drop with the page’s memory. We have no account library to reopen.

Expected requests

• Page assets. HTML, CSS, vendored JSZip, tool.js, and the icon — all GET, all from this site — when the page loads. Those scripts are library and UI code, not your logo.
• Analytics beacon, maybe. The privacy policy describes Cloudflare Web Analytics. If that product is enabled for the zone, a request to cloudflareinsights.com can show up. It is a page-view beacon. It is not an upload of image bytes. The HTML we ship does not include an advertising script.

Requests that should not appear

• A POST, PUT, or PATCH that carries your logo file, canvas blob, or text/emoji payload.
• A call to a third-party “favicon API”, cloud image editor, or remote logo URL fetch after you pick a file.
• A script load from an ad host. Response headers for this site set a strict script-src to 'self'. That policy does not list an ad network.

Why the bytes can stay in the tab

Image mode reads the file with the browser File API, draws it to canvas, and exports PNG/ICO sizes locally. Text and emoji modes paint a tile on canvas. JSZip packs the results into a downloadable blob URL. Results are local blobs — not a cloud job, and not a remote icon host. When you close the tab, those values go with the page’s memory. We have no account database to reopen.

This tool builds a favicon package for tabs, home screens, and simple manifests. It is not a full brand-asset DAM, cloud CDN, or trademark clearance service.

Publisher, contact, and policy pages

These pages stay on the existing URLs. They are how you learn who publishes the tool and how to reach us:

• About — who publishes the pages.dev experiment and what the generator is for.
• Contact — a working mailbox for wording and bugs, with clear “do not attach logos.”
• Privacy — no logo upload, hosting logs, optional Web Analytics, children note, AdSense stance.
• Terms — acceptable use, logo rights, honest limits.
• This trust page — a verifiable Network check for browser-local packaging.

This experiment does not run advertising scripts today. Response headers set script-src 'self'. If that ever changes, privacy and about would need an honest update first.

Where to go next

• Generate a favicon ZIP
• Favicon package checklist
• Favicon from PNG or SVG
• Text and emoji favicons
• Why local favicon tools matter
• About · Privacy · Terms · Contact

Questions about this wording, email contact@localfavicon.pages.dev. Do not attach unreleased logos or client marks to that email. We do not need them, and we do not want them in a mailbox.