26 lines
1.5 KiB
Markdown
26 lines
1.5 KiB
Markdown
# Privacy and security
|
|
|
|
Source files, decoded rasters, page settings and OCR text remain in browser
|
|
memory. There is no upload, telemetry, analytics, account, remote model, remote
|
|
font or external resource lookup. Production policy restricts connections to the
|
|
same origin, permits only same-origin/blob workers, and allows WebAssembly while
|
|
disabling object embedding. Browser tests reject unexpected HTTP requests.
|
|
|
|
Images are treated as untrusted. Compressed byte size, decoded pixel count, page
|
|
count, working-raster size and all output sizes are bounded. Active SVG is not an
|
|
advertised input and only the browser's raster decoders are accepted. The
|
|
projective transform rejects non-convex, tiny and degenerate corner selections.
|
|
Page rendering is sequential for PDF export to reduce peak memory.
|
|
|
|
OCR is isolated in the upstream Tesseract.js worker and is not initialized until
|
|
the user acknowledges its memory cost. Worker, core and language URLs are
|
|
constructed relative to the application base; the application never silently
|
|
falls back to the upstream CDN. Tesseract's IndexedDB model cache is disabled;
|
|
the ordinary PWA response cache may retain the same-origin public model file.
|
|
Cancellation terminates the worker. OCR text is untrusted text and is displayed
|
|
only through a text area, never as HTML.
|
|
|
|
PDFs are image-only. No claim is made that visible metadata, faces, signatures
|
|
or other sensitive page content has been removed. Export is always an explicit
|
|
user action.
|