This looks amazing. Just one question: what are the privacy guarantees? Will images, metadata, etc. always stay local and never be sent to another machine?
No. For example if you open an image from a URL, the photopea server will download it and serve it to the client. Unfortunately, I think this is technically necessary for many URLs because of cross origin policy.
