They do, so in theory everything after the '#' is not sent, however it frequently sends a request to "https://notepadtab.com/cdn-cgi/rum?" which is part of Cloudflare Analytics (https://www.cloudflare.com/en-au/web-analytics/). The payload includes "timingsV2" data, which leaks the hash part to the server.