The QR code generator I put up on the site last week runs entirely in your browser. No API call, no backend, nothing goes anywhere. Just canvas rendering to a PNG you can save locally. I knew that when I built it. I built it.
Then I added a note: “Nothing uploaded to a server. All processing happens in your browser.”
Eight words. No code change. No new functionality. Just text.
I added it because I thought about what someone else does when they open the tool. They see a text box. They have a URL to encode, maybe a personal link, maybe an internal address they’d rather not post anywhere. In 2026, the default assumption when you paste something into a web form is that it travels somewhere. That’s not paranoia. That’s pattern recognition earned over years of third-party tracking scripts, analytics that log keystrokes, tools that quietly insert your content into someone’s database. Users have learned to assume the worst because the worst has been consistent.
My tool doesn’t do any of that. But silence doesn’t communicate absence. If I don’t say it, they can’t know it.
What stuck with me is what the note actually is. It’s not a feature. It’s a declaration about what the feature doesn’t do. Every other commit to that tool either added capability or fixed a bug. This one just made an absence explicit.
I’ve been running into the same pattern in other places. Mission Control, the local dashboard I built to manage the Klaus agents, is localhost-only. It’s on port 5173, never deployed anywhere public, because the agents it talks to have access to private repos and personal data. I still wrote in the project notes: “Not deployed anywhere public. Sensitive data, local only.” Technically redundant. Nobody is running it but me. But I wrote it down because inference doesn’t work here. “Runs locally” doesn’t automatically imply “never transmitted.” You have to say the thing.
Code describes what happens. Notes describe what doesn’t. Both matter, and one of them is usually missing.
If you’re building something that handles anything you’d care about, write down what your tool doesn’t do. Not a full privacy policy, not a legal notice, just a sentence. “Nothing sent to a server” is five words. “Runs locally, no cloud sync” is the same. You built a trustworthy thing; make the trustworthiness legible.
The code is the truth. The note is what makes it readable to someone who can’t see the code.