Once is a small site with eleven tools. Ten of them are local verbs: they read a file you picked, work on it in this tab, and hand you a download. Those files are not sent to a Once server. There is no account, no cookie login, and no analytics pipeline attached to the file.
Convert image (including HEIC → JPG) decodes HEIC with a WebAssembly build of libheif (via the heic-to library) and re-encodes WebP, PNG, or JPEG with the canvas in this tab. Rotate / resize uses the same decoders and the canvas — quarter turns, flip, max-edge or box scale — still in this tab. Crop image uses the same decoders and the canvas — a free or locked-aspect rectangle, JPEG or PNG out — still in this tab. Compress image uses the same decoders and the canvas — quality slider, optional max edge, JPEG or WebP out — still in this tab. PDF merge, split, and rewrite run with pdf-lib in this tab. Compress video, Trim video, Extract audio, Convert audio, and Video to GIF load ffmpeg.wasm into this origin and run in a worker. In those cases the bytes stay in memory on your machine until you download or close the tab.
Transcribe is the exception, and it says so on its own page. The voice note is POSTed to this server, forwarded to Grok (xAI), and then dropped from memory. We do not write the upload to disk. We do not keep the audio after the response. The transcript is shown and downloadable without an account. xAI's retention of the request is theirs — that is the trade for this verb.
We count finished jobs in localStorage on this device only, so the footer can say how many jobs this browser has finished. That number is not sent anywhere. Clearing site data clears it.
The video and audio encoder's WebAssembly core is served from this same site (copied from @ffmpeg/core at install). Your file is not uploaded to that package's CDN. If a future host forgets the COOP/COEP headers, the page may lose SharedArrayBuffer; encoding can still run single-thread. Local verbs do not fall back to a server.
No ads on the download. No paywall. If someone later adds a verb that needs a queue or a login, that verb must say so on its own page. Transcribe already does.