It’s very doable, especially with small data.
Unfortunately, you have to take projects’ words that they do this on good faith as an end user. You’d need to GET the app bundle, and then firewall the tab / disable your network interface to be certain that no data is leaking out. It’s not so easy to control this as an end user these days, and web apps can be quite sneaky.
Maybe we’ll see some innovation in this space from browsers in the future, where an app can identify itself as local only and then be sandboxed by the browser.