3d-tools/docs/PRIVACY-SECURITY.md

Privacy and security

Selected files stay in browser memory. There is no telemetry, persistence, account, external asset or background upload. CSP allows same-origin application fetches only.

Files are capped at 32 MiB; geometry at one million vertices and triangles; scene nodes at 10,000; JSON at depth 64 and 100,000 nodes. Non-finite numbers, invalid indices, truncated records, oversized lists and external glTF resources are rejected. OBJ material-library references are displayed only as an import note and never fetched.

WebGL receives normalized numeric arrays and fixed built-in shaders. File text cannot become HTML, JavaScript or shader source. A context failure disables preview without blocking inspection or export.