Rowtrove

How to check that your PDF stays in your browser

Your documents and their contents never leave your browser.Rowtrove reads the PDF, finds the tables and writes the CSV on your device. You don't have to take our word for it: the browser itself enforces this, and you can check it.

The browser blocks uploads

Every page of Rowtrove is sent with a Content-Security-Policy header. The browser refuses anything the policy does not allow. Its connect-src directive lists every address the page may send data to:

connect-src 'self' https://cloud.umami.is

'self' is this site, which only serves the app's own files: it has no way to receive documents. The other address is Umami, our cookie-less statistics service. It receives page views and counts such as "a PDF was converted, 3 tables found", never document contents, filenames or table values. If you choose "Report a bad extraction", it also receives the summary you are shown first: page and table sizes and counts, no text.The page cannot load scripts from other sites, and the workers that read your PDF can only come from this site.

Check it yourself

  1. Open Rowtrove, then your browser's developer tools (F12, orCtrl+Shift+I; Cmd+Option+I on a Mac).
  2. In the Network tab, reload the page, select the first request and look at itsResponse headers. You will find the Content-Security-Policy and the other headers below.
  3. Keep the Network tab open while you convert a PDF and download the CSV. No request carries your file: the only requests are for the app's own scripts and styles, and the statistics counts described above.
  4. Or, from a terminal: curl -sI https://<this site>/ prints the same headers.

If anything ever tried to send data elsewhere, the browser would block it and report a Content-Security-Policy violation in the Console tab.

The whole policy

default-src
'none'
script-src
'self'
style-src
'self'
img-src
'self'
font-src
'self'
connect-src
'self' https://cloud.umami.is
worker-src
'self'
form-action
'self'
base-uri
'none'
object-src
'none'
frame-ancestors
'none'

script-src and style-src also list sha256-… hashes. Each allows one small inline script or style of the site's own, exactly as published. There is no'unsafe-inline' and no 'unsafe-eval'.

Other security headers

Strict-Transport-Security
max-age=63072000; includeSubDomains
X-Content-Type-Options
nosniff
Referrer-Policy
no-referrer
X-Frame-Options
DENY
Cross-Origin-Opener-Policy
same-origin
Permissions-Policy
camera=(), microphone=(), geolocation=()