SECURITY.md

Security and privacy

• All classification, training, metrics and exports run in your browser as JavaScript.
• The application bundles synthetic research examples only, not private files.
• User-entered examples are processed locally and are not intentionally transmitted over a network.
• Experiment history contains only date, dataset split, seed, model summary and numerical aggregate metrics. It is stored in the browser's localStorage (up to 15 entries), and can be cleared from the app.
• No credentials, cookies, telemetry, tokens, external scripts or API endpoints are required by the app.
• Inspect scripts before customizing or rehosting. Do not publish real private research texts as static assets.
• CSV exports are intended as diagnostic artifacts; avoid importing untrusted formula-bearing strings into spreadsheets without checking them.