~/safe
An app here talks to your files and to nothing else. No servers to call, no API keys, no account of its own. That is why it still runs in ten years, and it is also why it cannot leak your work: there is nowhere for it to send anything.
Why it matters
The reason you can't just run a random HTML file someone made is that you have no idea what it does with your data. General Text answers that structurally rather than by reputation, which is what turns a pile of one-off tools into something you can actually share, read, and build on.
What an app cannot do
See it for yourself. Open your browser's dev tools while an app runs and watch a blocked request to anywhere else. The guarantee made visible is the whole point.