Security

The main product path is designed around local browser processing rather than uploading media to my server for conversion or compression.

That model reduces server-side file handling, but it does not remove all security responsibility. The safety of the workflow still depends on your device, browser, extensions, operating system, and the public website infrastructure around the product.

Normal website traffic is intended to be served over HTTPS so that data exchanged with the public site is encrypted in transit.

This does not mean all downstream destinations are invisible. Analytics, monitoring, hosting, and other supporting systems may still receive the limited data described in my Privacy Policy.

The public site uses Google Analytics 4 for optional product analytics and OpenTelemetry with Uptrace for optional browser diagnostics.

Both categories stay off until you opt in through the site privacy settings.

Those integrations are configured to avoid file contents and raw file names in the normal browser-side workflow.

Some technical context may still be recorded for troubleshooting, including tool or page context, browser family, conversion stage, and file size-related metadata.

The public site already includes baseline browser security headers, privacy-aware monitoring sanitizers, and explicit boundaries around analytics payloads.

I also aim to keep privileged or secret-bearing behavior off the public browser path and to avoid logging secrets, tokens, raw file names, or file contents in normal product telemetry.

No public internet service can promise perfect security, perfect availability, or zero risk.

I do not currently publish claims such as SOC 2, ISO 27001, HIPAA, PCI, or similar formal compliance certifications for this public browser-first product unless I explicitly add and support those claims later.

Use a current browser, a trusted device, and a reasonably clean runtime environment when processing sensitive media.

Be careful with browser extensions, shared machines, public devices, and support requests that include unnecessary private details.

• Prefer current desktop browsers for larger or more sensitive jobs.
• Avoid sending private source files through email or any ad hoc contact path.
• Review downloaded outputs before publishing or sharing them.

If you believe you found a security issue in the public site, email creatorflowfeedback@gmail.com with a clear description, affected route, browser, and safe reproduction steps.

Please do not include secrets, tokens, or private files unless a secure and explicitly agreed workflow is in place.

Use the same email address for privacy or legal questions.