What this does with your camera

Your camera frames, your microphone audio, your uploaded background images and your recordings never leave your device. There is no account, no server, no database and no analytics. Nothing is stored for you anywhere, which also means nothing can be recovered for you.

Camera. Requested once, in the studio, when you press the button that asks for it. It is not requested on any other page — opening the home page or a guide does not activate a camera, and there is no code on those pages that could.

Microphone. Requested at the same time and genuinely optional. If you decline it, the app retries with video alone and you can record without sound.

Nothing else. No location, no notifications, no contacts, no clipboard. The site's Permissions-Policy header explicitly delegates only camera and microphone, and denies geolocation outright.

Camera frames go from the camera to a hidden video element, to the segmentation model, to a canvas. They exist as pixels in your graphics memory and are overwritten by the next frame. They are not accumulated, copied or serialised.

Microphone audio is attached directly to the recorder as a track, and is also read by a level meter that draws the bar you see. It is never buffered elsewhere. Muting disables the track feeding the recorder, so the file contains silence rather than audio somebody chose not to show you.

Your recording accumulates in the tab's memory in one-second pieces, is assembled into a single file when you stop, and stays there until you save it. Saving writes from memory to the location you choose — a real save dialog where your browser supports one, an ordinary download otherwise. Closing the tab first destroys it.

Background images you add are read from your disk into memory and kept in your browser's own IndexedDB so they are still there next time. “Upload” is the wrong word for it: the file never travels. It also never leaves that browser profile, so it will not appear on another machine or in a private window.

Your background choice is put in sessionStorage to carry it from the picker into the studio. It is one short string, and it is gone when you close the tab.

1. There is nothing to send to. The site is static files. It has no API routes, no server actions, no database client and no authentication. There is no endpoint anywhere in this project that could receive a video.

2. Your browser refuses the attempt. Every response carries a Content-Security-Policy whose connect-src permits this origin and local blob data, and nothing else. Any request to another host — fetch, XHR, WebSocket, beacon — is blocked by the browser itself. That holds even if a dependency misbehaves, which is the point of doing it this way rather than trusting the code.

3. Even the machine-learning model is first-party. The segmentation runtime and its weights are served from this domain, not from a CDN or a model host. That is what makes the policy above possible to keep as tight as it is — there is no third-party origin that needs allowing.

Worth disclosing because it is real. The segmentation library this app uses — Google's MediaPipe Tasks — constructs a usage-metrics reporter when it starts, and posts to a Google analytics endpoint on a timer. What it sends is not media: it is things like which task type was created and how long inference took.

It is still a third-party request, so it is refused twice. The app patches the browser's fetch to reject that host before the request is issued, and the Content-Security-Policy blocks it independently. The library treats a failed send as terminal and stops its own timer, so it happens at most once per page load and carries nothing.

That is the complete list. There is no other outbound request in the application, and the automated tests assert that none is attempted or completed.

It does not claim your recording is secure once you have saved it — it is a file on your disk, subject to whatever else has access to your disk.

It does not claim your browser, operating system or network cannot observe that you visited this site. Serving a page is a network request; the CSP governs what the page can do, not the fact of its being requested.

It does not claim your camera cannot be accessed by anything else on your machine. Nothing a web page does can make that guarantee.

And it does not claim to be a legal document. It is a factual description of the implementation, which is the thing actually worth reading.