Privacy

Stick positions, button presses and sensor readings are decoded and judged inside this browser tab, then discarded or kept on your machine only. The site ships no telemetry, no trackers and no third-party code, and its Content Security Policy refuses to talk to any other server. The live demo below lets you check that refusal yourself.

Signal path

The controller talks to your operating system, the OS hands it to the browser, and the browser hands it to this page. That is where the chain ends: decoding, drift maths and verdicts are all computed by scripts in the tab. There is no backend to receive anything, no account and no database.

Outbound traffic

Pages, scripts and styles are served from this domain only. The Content Security Policy printed below forbids connections to other servers, scripts from other origins and framing by other sites, so a request to the outside fails inside the browser before any packet is sent. If you want to double-check, open your browser’s developer tools on the Network tab while you test: every request goes to this domain.

What stays on this machine

Button layouts you built for non-standard pads, under rig.layout.*, one per USB vendor and product ID.
The outcome of your last stick checks, under rig.last.*, so you can compare after cleaning a stick.
An offline copy of the pages in the browser’s cache, so the bench opens without a connection.

None of it is uploaded. The wipe button removes the rig.* entries; clearing site data in the browser removes the cache too.

Deep mode permissions

Deep mode goes through WebHID. The browser first shows its own picker, and the page can open only the controller you selected there. A controller you allowed earlier is never reopened by itself: you press the reconnect button. “Forget” revokes the permission completely.

Try to send something out

This button asks the page to send a request to another site (an address that can never exist). The Content Security Policy should stop it before it leaves your browser.

The policy this page is served with

default-src 'none'; frame-ancestors 'none'; script-src 'self'; worker-src 'self'; connect-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; manifest-src 'self'; media-src 'self' blob:; form-action 'none'; base-uri 'none'; upgrade-insecure-requests

Checklist for this controller

Press the demo button below and watch the browser refuse the request.
Use the wipe button if you want the saved layouts and last results gone.

FAQ

Can a test session send my stick data anywhere?

No. The readings never leave the tab, and the page's security policy would not let it open a connection to another server even if it tried.

Any trackers, cookies or telemetry?

None of those. The web host logs page downloads as part of serving them; your controller readings are never in those logs.

How do I wipe what the bench saved?

Press the wipe button on this page. It deletes every entry whose name starts with rig. from this browser's local storage.