The server sees the connection
A site generally receives the public IP, request headers, protocol details, and metadata added by its infrastructure provider.
That information can reveal approximate network context, not a precise identity or physical address by itself.
Scripts see the page environment
JavaScript can read viewport, language, timezone, feature support, storage availability, and many device-adjacent attributes.
Technical availability is different from a site actually storing or sharing the information.
Permissions create boundaries
Precise location, camera, microphone, notifications, and some other capabilities require permission or a deliberate action.
Review prompts carefully and revoke permissions you no longer need.
Files are not openly browsable
An ordinary page cannot enumerate arbitrary local files. It can read a file you explicitly select or drop into an allowed control.
Local tools can process selected data without uploading it.
Inspect behavior, not slogans
Read the privacy notice, inspect network requests when needed, and prefer tools that explain what is local, transmitted, stored, and retained.
Absolute promises such as complete anonymity or universal no-logging claims deserve skepticism.