Third-party and runtime script policy

Public site

Every third-party resource, in one table

Vendored in the privacy build (served same-origin from /vendor/):
Name        Version   Public-site host        Purpose                        Privacy build
JSZip       3.10.1    cdnjs.cloudflare.com    ZIP creation for batch output  /vendor/jszip-3.10.1.min.js
pdf-lib     1.17.1    unpkg.com               PDF merge/split/compress      /vendor/pdf-lib-1.17.1.min.js
jsPDF       2.5.1     cdnjs.cloudflare.com    Images-to-PDF generation      /vendor/jspdf-2.5.1.umd.min.js
PDF.js      3.4.120   cdnjs.cloudflare.com    PDF rendering (+ worker)      /vendor/pdfjs-3.4.120.min.js
heic2any    0.0.4     cdn.jsdelivr.net        HEIC decode/convert           /vendor/heic2any-0.0.4.min.js

Removed entirely from the privacy build (no vendored equivalent):
Name                          Purpose                          Public-site host                 Privacy build
Google Tag Manager            Container GTM-KQHC5ZGV           www.googletagmanager.com          removed
AdSense (ads.txt pub-2823470980745945)  Ad serving  pagead2.googlesyndication.com     removed
Google Fonts (Inter, JetBr.)  Webfont delivery                 fonts.googleapis.com/gstatic.com removed, no vendored font
@imgly/background-removal    AI Deep Cutout inference + model  cdn.jsdelivr.net                  disabled, throws an explicit error
Cloudflare Web Analytics     Performance telemetry beacon      Cloudflare-injected beacon script (see docs/DEPLOYMENT_PRIVACY.md)  must stay disabled at host level

Why the audit skips vendor/

scripts/audit-privacy-build.js walks the generated artifact looking for disallowed hostnames and phrases, but it explicitly skips the vendor/ directory while doing so. The five vendored libraries are third-party code themselves, and their own minified source or embedded license comments can legitimately contain strings like a CDN hostname from where the library was originally published, which would otherwise trigger a false positive unrelated to what the site actually requests at runtime.

This means the audit's guarantee is about what the generated HTML, CSS, and top-level JavaScript reference and request, not a claim that the vendored files contain no historical reference to their origin. The version pinning and file inventory in THIRD_PARTIES.md is what ties each vendored file back to a specific, reviewable upstream release.

Privacy build

• No ads: Ad scripts and ad scaffold DOM are removed from the generated artifact.
• No analytics: GTM, the GTM noscript iframe, and analytics-events.js are stripped from the privacy build.
• No remote fonts: The Google Fonts preconnect links and stylesheet link are removed.
• No runtime CDNs: The five runtime libraries in the table above are served from same-origin vendored files instead.
• No host injection: Cloudflare Web Analytics, Zaraz, Rocket Loader, email obfuscation, and injected challenge scripts must remain disabled for privacy.convertunlimited.com, since those are configured outside this repository.

Font fallback in the privacy build

The site's CSS defines its font stack as Inter first, followed by system-ui, -apple-system, Helvetica Neue, Helvetica, Arial, and sans-serif. Because the privacy build removes the Google Fonts link and the CSP sets font-src 'self' with no vendored font file, Inter does not load there; the browser renders the next available font in that same stack instead. This is a visible side effect of the no-remote-fonts policy, not a separate font substitution step.

Related source documentation

• THIRD_PARTIES.md
• Privacy policy for the privacy build

FAQ

Does the privacy build load Google Tag Manager?

No. GTM is stripped from the privacy build.

Does the privacy build load Cloudflare Web Analytics?

It should not. If a beacon appears in rendered HTML, that is a Cloudflare dashboard configuration problem that must be disabled.

Are vendored libraries third-party code?

They are third-party libraries served from the same origin and tracked in the repository inventory, each pinned to the version listed in the table above.

Why does the privacy build look like it uses a different font?

Because Google Fonts is removed and no font is vendored locally, the browser falls back to the next font in the site's own CSS stack rather than loading Inter remotely.

Is the AI Deep Cutout model file vendored like the other libraries?

No. It is disabled outright in the privacy build rather than being downloaded and served same-origin, because of its size and because it is fetched at runtime rather than bundled with the page.

Where do these version numbers come from?

THIRD_PARTIES.md and the CDN-to-vendor mapping inside scripts/build-privacy.js, cross-checked against the actual script tags in the public HTML.