What localStorage actually is
Every modern browser sets aside a small, private storage area for each website, keyed to that site's own address. A page can write text into it and read it back later, and that is the entire mechanism: no server, no account, no network request involved in either direction. When a tool says your text "saves as you type," what is actually happening is the page writing the current text into that storage area every so often, using an ordinary browser feature that has existed since long before it became a selling point for a privacy-focused tool.
Why it stays on the device
localStorage is deliberately scoped to one origin, one specific combination of scheme, domain and port, and one specific browser installation. Nothing about the mechanism sends it anywhere else by default; a website would have to write separate code to read that data and transmit it over the network, which is exactly the step a genuinely private tool skips entirely. That is the structural difference between "the developer promises not to look at your data" and "the data never technically leaves your device in the first place." The second is a stronger claim, and it is what localStorage-based tools are actually built on.
The specific ways it can be lost
Because it lives on one device in one browser, several ordinary actions remove it entirely. Clearing browsing data or site data deletes it outright, since that is precisely what the "clear" action is for. A private or incognito window uses a separate, temporary storage area that is discarded when the window closes, by design, so anything written there never persists past that session. Switching to a different browser, or a different device, does not carry it over, since there is no sync mechanism built into localStorage at all: each browser on each device keeps its own separate copy. And browsers can and do evict local storage on their own under some circumstances, for example when a device is critically low on storage space.
What it is not built for
localStorage is not a backup service, and treating it like one is the most common way people are surprised by losing something. It has no redundancy, no cloud copy, and no protection against any of the situations above. For a quick note you are actively working on, it is close to ideal: instant, private, and there the moment you reopen the tab. For anything you genuinely cannot afford to lose, the safer habit is downloading it as a real file the moment it starts to matter, rather than trusting any browser's storage indefinitely.
Seeing it in practice
The online notepad on this site writes to localStorage on every change, which is why it has no save button: there is nothing to click, because there is no separate save step happening. The same mechanism runs the autosave on the to-do list and the plain text editor, all using the same browser feature rather than three different systems doing the same job.