Private by architecture, careful by default.

Security principles

Local processing, no launch accounts, no server-side contact conversion, safe text rendering, bounded work for large files, same-origin security headers, and no contact values in logs are the baseline. The repository also maintains a threat model, privacy architecture, dependency notices, and hostile fixtures.

File and parser boundaries

Inputs are checked by extension and content signature, size-limited, parsed as data, and never executed as scripts, formulas, macros, or HTML. Remote photo URLs are not fetched. Generated HTML and spreadsheet outputs escape user values and disclose formula-safety transformations.

Browser verification

To inspect the boundary yourself, open developer tools, select the Network tab, load the synthetic sample, and confirm that no request contains the file contents, contact values, or filenames. Browser extensions, operating-system backups, downloads, and compromised devices remain outside this application's control.

Responsible disclosure

If you find a security issue, use the Contact page to share the affected route, reproduction steps, browser, and whether contact data was involved. Do not include real personal contact files in a report.

Last review and scope

This page describes the current browser-local product. The security model must be revisited before enabling analytics, advertising, error monitoring, local recovery drafts, cross-origin workspaces, or any future sync capability.