962 B
Privacy and security
Font bytes, preview text and generated output stay in memory. There is no telemetry, URL import, remote font lookup or automatic upload. Explicit local downloads are the only output. Parsing uses strict size/table/expansion/glyph caps, a disposable worker and a deadline. User metadata is rendered as text; preview HTML is escaped and confined to a scriptless sandbox.
Collection face selection keeps the original TTC/OTC in its disposable worker. Only the selected face is reconstructed into a bounded temporary Blob for the sandboxed preview; it is revoked on replacement and is not exposed as an export. TTC 2.0 DSIG boundaries are validated and reported, but signatures are not cryptographically verified.
The OS/2 fsType field is technical metadata, not legal advice. Font Tools
blocks subsetting when it declares restricted embedding, no-subsetting or
bitmap-only embedding, but users must still comply with the actual licence.