Where your data lives
Noctet has no backend. What you paste is parsed by code that already sits in this browser, and after loading, the app requests nothing from the network beyond its own files. This page describes how that is built and what you can look at yourself.
1. Watch the network
Open the app, then open your browser's developer tools (F12) and switch to the Network tab. Reload once so the panel starts clean, then use the app: paste addresses, tokens, certificates, logs, anything.
You will see requests only to the app's own domain, and only for its own static files: HTML, JavaScript, CSS, the bundled typeface and the vendor database. Once the app is cached the panel stays empty while you work. Noctet's own source contains no outgoing request at all: no fetch, no XMLHttpRequest, no sendBeacon, no WebSocket, no third-party SDK. The typeface ships inside the app, so there is no font or CDN request either.
2. Cut the network
Load the app once, then switch the device to airplane mode, or unplug the cable, or use the developer tools' Offline throttle. Every module keeps working: the app, including all reference tables and the vendor database, is installed into the browser's cache by a service worker.
3. Block it at the firewall
The strictest check does not rely on the browser. Block outbound traffic from the machine to everything except the app's domain while you work, or block the app's domain too once it has loaded. Noctet keeps running: the only request it makes afterwards is the service worker asking its own domain whether its own files have changed.
4. Read the headers
The app ships a strict Content-Security-Policy, default-src 'self' with connect-src 'self', both as a response header and as a meta tag in the document. The browser enforces it: a script on this page can only open connections to the app's own host, which covers fetch, XMLHttpRequest, WebSocket and sendBeacon. It does not cover a link you tap yourself, which is an ordinary navigation and stays visible to you. The privacy policy, the legal disclosure and the support link, all three under System, are those links.
Check the policy with curl -I https://noctet.feymluna.com/ or under the document's response headers in the developer tools.
5. Read what actually ships
Noctet is closed source, and that costs you nothing above: none of checks 1 to 4 needs the source. What does help is that everything the browser executes is served to it and can be read in the developer tools. The service worker is the only component that touches the network at all; it is under 3 kB and its whole job fits on one screen. The production supply chain is deliberately tiny: React, the bundled monospace font, and the Capacitor bridge that the Android build uses for the file and share dialogs, which the browser build never loads. Their full license texts sit under System, Licenses, and the dependencies are locked and audited in CI.
What is stored on this device
Tool inputs and the theme go to this browser's local storage so your work survives a reload. A token pasted into the JWT field goes to session storage, which the browser clears when the session ends. Secrets and private keys are written to neither; they stay in memory while the page is open. Each module has a Clear button for its own inputs, and everything can be wiped at once under System, Delete all local data. What you copy to the clipboard or download as a file leaves the app because you asked it to.
If something looks off
If you ever see a request that does not belong, that would be a bug worth fixing. Reports are welcome: contact@feymluna.com