1.0 KiB
Privacy and security
Subtitle and media files are read only after direct selection and stay in page
memory. No telemetry, analytics, account, upload, external font, codec, model or
other network destination exists. The production policy uses
connect-src 'self'; browser tests fail on non-local requests.
Subtitle text is rendered by React as text, not interpreted as HTML. ASS override codes and WebVTT tags are preserved as inert source. TTML import rejects document types and entity declarations and reads a deliberately flat, bounded profile; it does not fetch referenced styles, images, fonts or other resources. Exports are downloads chosen by the user. Browser-native media playback and Web Audio decoding inherit browser codec support and may allocate substantial memory inside the documented bounds.
Validation findings are editorial signals. They are not proof of accessibility, broadcast conformance, synchronization quality or legal compliance. Cross-format conversion can discard styles, positioning, regions, comments and metadata.