midi-tools/public/docs/PRIVACY-SECURITY.md

Privacy and security

MIDI bytes are read into browser memory only. The application has no telemetry, account, database, remote asset or network client. CSP restricts connections and media to the application origin or local blobs.

Parsing and export enforce an 8 MiB file bound, 256 tracks, 250,000 events, a 1 MiB aggregate SysEx bound, four-byte VLQs and signed-safe absolute ticks. Playback is explicitly user started, schedules at most 2,000 notes and is stopped by closing its audio context. Imported text appears only as escaped React text and is never interpreted as markup, script, URL or shader.