10 lines
1.4 KiB
Markdown
10 lines
1.4 KiB
Markdown
# Privacy and security
|
|
|
|
Source vCards, CSV, parsed contacts and QR output stay in page memory. There is no telemetry, analytics, account, persistence or runtime network path. Imported values are rendered through text nodes and native form controls, not as executable HTML. Generated QR SVG is checked for active constructs and used as an encoded image source.
|
|
|
|
Files and pasted sources are rejected above 2 MiB; parsing is additionally limited to 50,000 physical lines, 2,000 cards and 64 KiB per property. QR payloads use a conservative 2,400-byte cap. These limits reduce accidental resource exhaustion but do not validate contact claims or make an imported URL, address or note trustworthy.
|
|
|
|
Email/phone/name normalization is used only to produce explainable duplicate candidates. Merge is deliberately left-biased and lists scalar conflicts before the user applies it. Overview screens mask emails and phones until explicitly revealed; source and edit views necessarily contain the full values. “Clear workspace” drops app references but cannot erase browser or operating-system memory forensic traces.
|
|
|
|
CSV export prefixes cell values beginning with `=`, `+`, `-`, or `@` with an apostrophe so common spreadsheet applications do not execute imported contact values as formulas. That defensive prefix intentionally changes such exported cells and should be reviewed when round-tripping into a non-spreadsheet system.
|