There is a level of trust involved as unless you pull down the code, audit it and only ever run it locally, you really have no way of knowing that on any given page load the code hasn't changed.

While I also appreciate tools that don't send data, I don't like the normalization of teaching people to paste (potentially) private data into a browser while blindly trusting that it's not being offloaded to some server somewhere.