Is it safe to paste a confidential script into an online teleprompter?
Some scripts cannot go into a box you have not checked. Here is how to audit any web teleprompter yourself, in about two minutes, with DevTools and nothing else.
It depends entirely on the tool, and you can settle it yourself in about two minutes. Open the browser's developer tools, go to the Network tab, type your script into the teleprompter, and watch: a tool that keeps your script local will make no requests at all while you type. One that sends it somewhere will show you the request and, in its payload, your words. Anything requiring an account is sending your script to a server by definition, because that is where the account lives.
Most scripts do not need any of this. A YouTube intro is going on YouTube.
Some do. Unreleased results being read to camera the day before they are announced. A resignation statement. A deposition prep. A clinician rehearsing how to deliver a diagnosis. A legal notice with a client’s name in it. For those, “I pasted it into a website I found” is an answer somebody may eventually ask you to defend.
The good news is that you do not have to take anyone’s word for it, including ours. The browser will tell you.
The two-minute audit
Works on any web tool, not just a teleprompter. You need no extensions and no technical background beyond the willingness to open a panel.
- Open developer tools.
F12, or ⌥⌘I on a Mac, or right-click → Inspect. - Go to the Network tab, and clear it. There is a 🚫 or “Clear” button. You want to see what happens from now, not what happened on load.
- Type or paste your script into the tool. Use a nonsense script for the test, not the real one.
- Watch the list.
That is the whole test, and the result is not ambiguous:
- Nothing appears. No request was made. Your script went nowhere, because there was nothing to carry it.
- Requests appear. Click one. Look at the Payload or Request tab. If your words are in there, your words left the machine. Where they went next is now someone else’s policy document.
Some requests are innocent — a font, an image, an error reporter. The question is never “did the page make any request”, it is “is my script inside one of them”, and the payload view answers that directly.
Three more things worth thirty seconds each
Check what persists. Application tab → Local Storage. This is where a local-first tool keeps your script, and seeing it there is a good sign — it means the script is on your disk rather than someone’s database. It also means it is still there for the next person who opens that browser. More on that below.
Check the permissions. A teleprompter is text on a screen. It has no business asking for a camera or a microphone, and if it does, you should know why before you answer the prompt.
Check the response headers. Network tab → the main document → Headers. A Permissions-Policy listing camera=() and microphone=() means the server has forbidden the page from asking at all — not merely that it currently doesn’t. That is a meaningfully stronger claim than a sentence on a privacy page, because it is enforced by the browser rather than by the developer’s good intentions.
The shortcut: does it want an account?
If a teleprompter requires you to sign in, the audit is already over. An account exists on a server, so your scripts are on that server. That is not an accusation — it is the architecture, and it is the only way sync, sharing and team libraries can work. Those features are genuinely useful and plenty of people should want them.
But it does mean the honest question changes shape. It stops being “does this tool upload my script” — it does — and becomes “do I trust this company’s retention policy, breach history, jurisdiction and sub-processors with this particular document.” Which is a reasonable thing to decide yes to. It is just a much bigger question than the one you thought you were asking, and you should know you are answering it.
What LensCue does, and how to check
We are a static site. There is no server to receive a script, no account, no analytics, and no third-party scripts — the fonts are served from our own origin rather than a font CDN, which is itself a request that would otherwise leave your machine on every page load.
Your script and settings live in your browser’s local storage under lenscue.script.v2 and lenscue.settings.v2. That is why they survive a refresh. Nothing copies them anywhere.
Run the audit above on us. The Network tab should stay empty while you type. That is the point of writing this: a claim you can falsify in two minutes is worth more than a privacy policy you have to read.
The honest caveats
A tool that stores your script locally is not the same as a tool that keeps your secret. Three things to be clear about:
Local storage is local to the machine, not to you. On a shared, borrowed or kiosk computer, your script is sitting there for the next person who opens that browser. Use the Reset button when you are done, or work in a private window, which discards its storage when you close it.
Anything on the same origin can read it. Local storage is not encrypted and offers no protection against a malicious browser extension, which runs with access to the pages you visit. If your threat model includes your own browser, a web tool of any kind is the wrong answer.
“No network” is a property of the page, not a promise about the future. We can only tell you what today’s code does. The test above is how you confirm that for yourself on the day you use it, which is the right way round.
For most people, most of the time, none of this matters and a signed-in tool with a good sync feature is the better product. For the handful of scripts where it does matter — you will know which ones — the test takes two minutes and it is the same two minutes whichever tool you end up choosing.
LensCue is a free online teleprompter with no signup and no uploads. The privacy page states the same thing in fewer words, and the audit above is how you check it.