18 lines
1.1 KiB
Markdown
18 lines
1.1 KiB
Markdown
# Privacy and security
|
|
|
|
MIDI bytes are read into browser memory only. The application has no telemetry, account, database, remote asset or network client. CSP restricts connections and media to the application origin or local blobs.
|
|
|
|
Parsing and export enforce an 8 MiB file bound, 256 tracks, 250,000 events, a
|
|
1 MiB aggregate SysEx bound, four-byte VLQs and signed-safe absolute ticks.
|
|
Worker messages are revision-scoped, and cancellation terminates the disposable
|
|
worker before stale results can update the document.
|
|
|
|
Web Audio and Web MIDI playback are explicitly user started and schedule at most
|
|
2,000 notes over the first 900 seconds. Web MIDI permission is requested with
|
|
SysEx disabled; the app does not subscribe to MIDI inputs and sends only channel
|
|
note messages to the selected output. Stop clears scheduled output and sends
|
|
all-notes-off on every channel. Local SoundFont inspection is capped at 128 MiB,
|
|
validates bounded RIFF structure and reports metadata only; it neither
|
|
synthesizes the bank nor resolves remote resources. Imported text appears only
|
|
as escaped React text and is never interpreted as markup, script, URL or shader.
|