# Privacy and security

Source files, decoded rasters, page settings and OCR text remain in browser
memory. There is no upload, telemetry, analytics, account, remote model, remote
font or external resource lookup. Production policy restricts connections to the
same origin, permits only same-origin/blob workers, and allows WebAssembly while
disabling object embedding. Browser tests reject unexpected HTTP requests.

Images are treated as untrusted. Compressed byte size, decoded pixel count, page
count, working-raster size and all output sizes are bounded. Active SVG is not an
advertised input and only the browser's raster decoders are accepted. The
projective transform rejects non-convex, tiny and degenerate corner selections.
Page rendering is sequential for PDF export to reduce peak memory.

OCR is isolated in the upstream Tesseract.js worker and is not initialized until
the user acknowledges its memory cost. Worker, core and language URLs are
constructed relative to the application base; the application never silently
falls back to the upstream CDN. Tesseract's IndexedDB model cache is disabled;
the ordinary PWA response cache may retain the same-origin public model file.
Cancellation terminates the worker. OCR text is untrusted text and is displayed
only through a text area, never as HTML.

PDFs are image-only. No claim is made that visible metadata, faces, signatures
or other sensitive page content has been removed. Export is always an explicit
user action.