It's like saying, I'm gonna stick to Notepad and not use a proper IDE because I'm not sure if they send the code I write back to themselves.
Anyway, I share your nagging doubt and I'd never paste any text containing sensitive information into any text pane on a web page, not regexr, not JSON formatters, not anywhere.
I use regexhero.net for .NET regex support.
So far, I've been using regex101 even for building C# .NET regex because I haven't needed Microsoft-specific behavior.
That regexhero.net is an interesting link. I would have preferred that the website built a .NET compatible engine by extracting the actual source code[1] available from Microsoft. That way, it wouldn't require using the Silverlight plugin. However, I understand why Silverlight would be the easiest way.
[1] https://referencesource.microsoft.com/#System/regex/system/t...
and may also use transpiler: https://www.google.com/search?q=C%23+to+javascript+transpile...
That seems to be the approach http://regexstorm.net/tester took, at least. It's low frills (only highlights matches), but it's good for making sure that the problem really and truly isn't some weird regex quirk.