What leaves your machine
anonymizer is built on a single hard rule: the redaction engine never opens a socket. This page enumerates every network request the product can possibly make and when.
During redaction — nothing
Zero outbound requests. Zero loopback requests except the local browser ↔ web UI traffic on 127.0.0.1. Enforced by tests/integration/test_no_network.py which fails CI if any socket opens during a redaction run.
During launch — one optional request
On launch, the web UI fetches https://anonymizer.site/version.json with a 2-second timeout to check for updates. This is the only thing.
- What’s sent: an HTTP GET. No User-Agent identifier beyond
python-requests/<version>. No referer. No cookies. - What’s received: a JSON blob with the latest version string and its SHA256.
Disable it: ANONYMIZER_DISABLE_UPDATE_CHECK=1.
When you click “Update now” — once
If you accept an update in the in-UI banner, the detached anonymizer.updater runs uv tool upgrade docs-anonymizer. That command pulls the new wheel from PyPI (or your configured mirror, see Corporate setup).
This is initiated by your click — not automatic.
When you click “Report” — never automatic
Feedback is never sent automatically. The Report dialog produces a JSON payload that you copy and share manually (Slack, email, ticket). See Reporting feedback.
What’s NOT done, ever
- No analytics. No Google Analytics, no Plausible, no Umami, no first-party pings.
- No crash reporting. Crashes go into
~/.anonymizer/logs/. They’re never uploaded. - No font/CSS hosted externally. Everything ships with the wheel.
- No NER model downloads at runtime. Models are bundled with the wheel.
If you observe network behavior other than what’s listed above, that’s a critical bug — please report it.