# Privacy and security

There is no telemetry, remote asset, account, database or application network client. CSP limits connections to self. Passive inspection never asks for permission; sensitive checks require explicit user actions and potential prompts are labelled.

The tool deliberately does not read user agent, locale, device names or IDs; does not obtain WebGL debug renderer details; does not generate canvas/audio samples; and does not combine results into an identifier, hash or score. Returned media tracks stop immediately. Battery listeners are never installed. Exports contain an allow-listed schema with broad buckets for high-entropy measurements and omit timestamps.

Capability presence is not a security guarantee: browser policy, embedding, HTTPS, user choice and operating-system controls can still block a later operation.