# Privacy and security

Subtitle and media files are read only after direct selection and stay in page
memory. No telemetry, analytics, account, upload, external font, codec, model or
other network destination exists. The production policy uses
`connect-src 'self'`; browser tests fail on non-local requests.

Subtitle text is rendered by React as text, not interpreted as HTML. ASS override
codes and WebVTT tags are preserved as inert source. Exports are downloads chosen
by the user. Browser-native media playback and Web Audio decoding inherit browser
codec support and may allocate substantial memory inside the documented bounds.

Validation findings are editorial signals. They are not proof of accessibility,
broadcast conformance, synchronization quality or legal compliance. Cross-format
conversion can discard styles, positioning, regions, comments and metadata.