# Privacy and security

Calendar source, parsed events, merge inputs and diagnostic output stay in page memory. There is no telemetry, analytics, account, persistence or runtime network path. Imported summaries, descriptions, locations, UIDs and organizer values are rendered as text, never executable markup.

Files and pasted sources are rejected above 4 MiB; the preflight also caps physical lines, components and events. Recurrence has both per-series and time-horizon bounds and the conflict list is capped. These limits reduce accidental resource exhaustion but do not validate meeting claims or attendee identities.

Repair intentionally normalizes only transport structure and required calendar metadata; it does not invent DTSTART, UID, timezone law or recurrence. Merge can discard an older component with the same identity, so its selection rule and count remain visible. Browser timezone data varies by runtime version; DST results are diagnostics, not a legal source of civil-time truth.