Whether you're checking a snippet from a tutorial, previewing an email template, or opening an .html file without trusting it, HTML Viewer renders it for you locally, in a sandboxed frame that can't touch the rest of your browser.
The preview runs inside a sandboxed iframe that's isolated from this site and the rest of your browser; it can't read cookies, local storage, or other tabs, and can't navigate your browser away from this page. It's a much safer way to look at unfamiliar HTML than opening it directly, though no sandbox makes running arbitrary code from a stranger risk-free, so stay cautious with anything you don't recognize.
Most HTML previews, like checking layout or markup, don't need it, so it stays off until you turn it on. Keeping it off also keeps the sandbox at its most restrictive, which is the safer default.
No. Everything, reading the file, rendering the preview, and full-screen mode, happens locally in your browser. Nothing about your HTML is sent anywhere.
Not directly. HTML Viewer renders a single HTML document; it can't resolve separate local CSS, JavaScript, or image files referenced by relative paths. Linked content from the internet (external stylesheets, scripts, or images from the web) will still load normally, since the sandbox restricts access to your browser, not to the internet.