900 B
Privacy and security model
Merge records and images stay in browser memory and are only serialized when the user explicitly exports. The application performs no telemetry, upload, remote font loading or network lookup. Barcode payload URLs are encoded as data inside the symbol; they are never requested.
CSV/JSON structure, field lengths, record counts, image bytes/pixels, grid dimensions, calibration and output pages are bounded. Object URLs are revoked. User strings are normalized for label display and XML-escaped. Only built-in templates are supported, and only locally decoded PNG/JPEG/WebP is embedded.
Printing crosses a physical boundary the browser cannot verify: installed font metrics, device drivers, page scaling, feed skew and stock tolerances. Use the calibration controls and test on plain paper. PDF is a 144 DPI raster export and does not embed or preserve font semantics.