No silent original upload.
The normal editor has no full-original upload route. IndexedDB is used for device-local projects and source blobs.
Security & privacy
Your original does not need to visit our server.
The editor keeps imported originals and project blobs in your browser by default. Commercial state remains authoritative on the server.
Type, size and dimension guards.
JPEG, PNG and WebP magic is checked before decode; malformed files and image bombs fail with a clear error.
Organisation-scoped authority.
Projects, usage, subscriptions, entitlements, devices and jobs require an authenticated membership and explicit organisation boundary.
Atomic server permits.
An immediate SQLite transaction and unique project/day key prevent normal multi-tab races from exceeding Free allowance.
Provider events fail closed.
Financial ledgers are separate and immutable. Webhook adapters require signature verification and idempotent event ids before activation.
External providers start off.
No key reaches the browser, no external AI call is made by default, and unavailable tools never claim a result.