Security and privacy

Your documents stay on your device

Conversion runs inside your browser as WebAssembly. The document is read by the page, handed to a worker, and converted there. It is never sent anywhere, and there is no server that could receive it: this site is static files.

What the engine can do

The browser module is built for a target with no host interface at all. It imports nothing — no filesystem, no network, no clock, no randomness, no threads — and a release build is checked against that claim by parsing the compiled module's import table, not by reading a tool's summary of it. A conversion cannot follow a link, fetch an image, or read a file beside the one you chose.

What this site does not do

There is no analytics, no advertising, no session replay, no remote font, no tag manager, and no account. The only thing stored on your device is your colour theme preference.

What we cannot protect against here

This site is served by GitHub Pages, which does not let us set response headers. Our content policy therefore travels in the page, and a policy delivered that way cannot stop the site being embedded in a frame by another site. We record that as a known gap rather than implying protection we do not have. It is tolerable only because this site holds no credential, no session, and no action another site could induce you to take.

Reporting a problem

Report a vulnerability through the repository's security policy. Please do not include a document you cannot share publicly.