Browser-local by default
PDFs, images, documents, media, text, and calculator inputs are processed on your device whenever the tool page says they are. File-processing code and major libraries are shipped with the site instead of silently forwarding your file to a conversion API.
Permission boundaries
Camera and microphone access is available only to same-origin recorder tools and still requires the browser's explicit user permission. Geolocation and unrelated device capabilities are disabled. No tool can bypass the browser permission prompt.
Defensive controls
The production package sets HTTPS-only transport, content-type protection, clickjacking controls, a restrictive Content Security Policy, referrer limits, and long-lived caching for versioned static assets. File size, page count, duration, and pixel limits protect the browser from accidental resource exhaustion.
Third-party resources
Processing dependencies are bundled locally with license notices. The Google Fonts pairing preview is the documented exception and loads font resources from Google; it does not send uploaded files. Analytics, when enabled, is configured separately from file processing.
Responsible disclosure
Do not send sensitive example files. Report a security concern through Inqita Support with the affected URL, browser, and reproducible steps.