Privacy: what this page can and cannot do

The Content-Security-Policy

Every page on log.grepboard.com is served with this policy (the hash is the one small inline script that applies your theme before the first paint):

default-src 'none';
script-src 'self' 'wasm-unsafe-eval' 'sha256-…';
style-src 'self';
img-src 'self' data: blob:;
font-src 'self';
worker-src 'self';
connect-src 'none';
manifest-src 'self';
base-uri 'none';
form-action 'none';
frame-ancestors 'none'

Other response headers: Referrer-Policy: no-referrer (links you follow from here do not tell the next site where you came from), X-Content-Type-Options: nosniff, Permissions-Policy: camera=(), microphone=(), geolocation=(), Strict-Transport-Security and Cross-Origin-Opener-Policy: same-origin.

What is stored, and where

• No cookies.
• No analytics script, no tracking pixel, no ad script on log.grepboard.com.
• Your logs are held in the tab's memory while it is open and are gone when you close or reload it.
• Local storage in your browser keeps a few preferences: gb.theme (light or dark), gb.style (visual style), gb.introHideUntil (when the privacy notice may show again), gb.recipes (custom format recipes you saved) and gb.mask (only present when you turn export masking off). None of them contain log lines. Clearing site data removes them.

The server that delivers the page sees what any web server sees when a page and its files are requested: your IP address, user agent and the paths of those files. It never sees your logs, because the page cannot send them.

What the policy does not cover

Being exact about the limits is part of the point:

• Browser extensions run with their own permissions and can read any page you open, this one included. If you use extensions you do not trust, use a clean browser profile for sensitive logs.
• What you export or copy is yours to handle. Exports contain aggregated numbers, not raw lines. Masking is on by default: IP addresses keep only their first two parts plus a short tag, and emails become ***@***, and long hex or base64 tokens and password=/token=-style values become ***. Paths and other labels from the top lists are still shown, so review before sending.
• Report links and recipe links put their content after the # in the address. Browsers never send that part to a server — not to log.grepboard.com when the link is opened, and not in the Referer header. A report link holds the aggregated board (no raw lines; masked unless you turned masking off); a recipe link holds the recipe itself — its name, how lines are split, field names and roles, and any regex, format definition, time format or time zone you set — but no log lines. Anyone who has the link can read what is in it, the same as a file you send.
• CSP does not govern where a link takes you. The page never puts raw log lines into links; report links contain only what the report shows.
• Fonts are not a side channel here. The page preloads the same three Latin font files on every visit, before any log is opened, and draws everything that comes from a log (and all non-Latin text) with fonts already installed on your system. Nothing about your log changes which files the browser asks for.

How to verify it yourself

1. Check the header from a terminal: curl -sI https://log.grepboard.com/ | grep -i '^content-security-policy'
2. In the browser, open DevTools → Network, tick "Preserve log", reload. Click the document request; the content-security-policy response header is there.
3. Clear the list and drop a log. No request carries data.
4. In the DevTools Console, run fetch("https://example.com"). The browser refuses it and reports a Content-Security-Policy violation for connect-src.
5. Switch the Network throttling to Offline and drop another file. It still works, because it never needed the network.