Is my pattern or my text sent anywhere?

No. It runs in the page, and that matters here more than almost anywhere else: the test string is by definition the data you are trying to match, which means people paste production log lines and real customer records into these boxes constantly.

Why does it refuse some patterns?

Because they would freeze the tab. A quantifier inside a quantified group, such as (a+)+, gives the engine exponentially many ways to divide the input, and on a string that ultimately fails to match it tries all of them. Forty characters takes minutes. JavaScript cannot interrupt a running regular expression, so the only way to protect you is to recognise the shape and not start.

Can I still test a pattern like that?

Yes, on a short string. Under 25 characters the blow up is still instant, so the tool runs it. That is usually enough to see what it does, and the refusal message on a longer input is itself the answer you were looking for.

Regex Tester

Every match, every group, nothing uploaded.

Pattern

Test against

Ignore caseYes

Multiline^ and $ match at each line

Dot matches newlineYes

Every match, every group, nothing uploaded.

How to use it

Write the pattern. Without the slashes. Flags are the toggles underneath.
Paste the text. Every match is listed with its position and its groups.
Read the groups. Named groups are shown by name, numbered ones as $1, $2.

When you would use this

A regex tester is one of the tools most likely to be handed something confidential, because the test string is by definition the data you are trying to match. That is a production log line, an export, a list of real addresses. Every hosted tester receives a copy of both the pattern and the text. This one runs in the page, so there is nothing to receive them. The other difference is that it will not hang. A quantifier inside a quantified group, the classic (a+)+ shape, gives the engine exponentially many ways to divide the input, and on a string that fails to match it tries every one of them. Forty characters against that pattern takes minutes, and the tab is frozen for all of it because JavaScript cannot interrupt a regular expression once it has started. So the shape is recognised before the pattern runs, and a long input is refused with an explanation rather than attempted. Short inputs still run, since the blow up is instant there and investigating it is exactly why you opened a tester. Every match comes back with its position and its groups, named ones by name.

Questions

Is my pattern or my text sent anywhere?: No. It runs in the page, and that matters here more than almost anywhere else: the test string is by definition the data you are trying to match, which means people paste production log lines and real customer records into these boxes constantly.
Why does it refuse some patterns?: Because they would freeze the tab. A quantifier inside a quantified group, such as (a+)+, gives the engine exponentially many ways to divide the input, and on a string that ultimately fails to match it tries all of them. Forty characters takes minutes. JavaScript cannot interrupt a running regular expression, so the only way to protect you is to recognise the shape and not start.
Can I still test a pattern like that?: Yes, on a short string. Under 25 characters the blow up is still instant, so the tool runs it. That is usually enough to see what it does, and the refusal message on a longer input is itself the answer you were looking for.