Security and privacy
What is promised
No byte of a measurement file, and no name from it, leaves your browser. This covers the values of every channel, the names of the file, its groups, channels and properties, the property values, and anything computed from them: statistics, plots, exports.
The file is read in your browser tab, by a reader compiled to WebAssembly. Exports are built in the same tab and saved by your browser. The site's server has no way to receive a file: it only counts anonymous events, listed below.
How to check it yourself
From the quickest check to the most thorough.
- Disconnect from the network. After a first visit, the application is stored by your browser. Turn off Wi-Fi, reload the page, open a file, plot it, export it. Everything works, because nothing needs the network.
- Watch the Network tab. Open your browser's developer tools, then the Network tab, and open a
file. The requests are for the application's own files (scripts, styles and the reader module) and small
POST requests to
/api/event, each carrying one of the counters listed below. None carries data from your file. - Read the Content Security Policy. Every page is served with the header
connect-src 'self': the browser itself refuses any connection to another site, whatever the page tries. You can see this header in the developer tools, on any response from this site.
What is not promised
| That the host does not see your visit | Loading a page leaves a trace with the host, such as your IP address and the time, as on any website. |
|---|---|
| That your browser or computer is safe | A browser extension or other software on your computer can read what a page shows. This is outside the tool's reach. |
| That the file cannot leave another way | The tool never sends it. Copying it, emailing it or syncing its folder is up to you. |
What the server counts
To know whether the tool is used, the page sends the name of a few events. The server adds one to a counter for that event and that day, and keeps nothing else: no IP address, no browser details, no time of day, no identifier, and no record per visit. Anything outside this list is refused.
app_loaded | The application was opened. |
|---|---|
file_opened | A file was read. Sent with its size range (under 1 MB, 1 to 10 MB, 10 to 100 MB, 100 MB to 1 GB, over 1 GB) and whether a .tdms_index file was given. The size range is the only information about a file that is sent, and it is too coarse to recognise one. |
plot_rendered | A file's first plot was drawn. |
export_csv, export_parquet | An export finished. Sent with the same size range. |
parse_warning, parse_error | The reader met a problem. Sent with a fixed code, such as TRUNCATED_SEGMENT, never with a
message, a name or a position from the file. |
batch_extract_interest, interest_submitted | The planned Batch Extract tool was opened, or someone asked to be told when it is released. |
What is stored
In your browser: the application's files, so that it works offline, and your choice of light or dark mode. Never a measurement file, a name or a value from one, and nothing used for counting. On the server: the daily counters above, and the email addresses of people who asked to hear about Batch Extract, as the privacy policy describes.
Files that try to break the reader
Every file is treated as possibly malformed or hostile. Every length and count read from a file is checked before memory is used. The reader is tested against the npTDMS library on synthetic files, including truncated and deliberately hostile ones, and fuzzed with hundreds of millions of generated inputs. A file it cannot fully read gives a partial result and a message saying what was skipped, never a crash.