Security

Last updated: 2026-07-31

Model in one sentence

The online protractor is designed so measurement and image handling for the tool run in your browser; the site itself is static content delivered over HTTPS.

Browser-only processing

• Canvas drawing and atan2-style angle math execute on your device
• Uploaded or pasted images are read locally (for example via object URLs) and drawn on the canvas
• Copy/export uses browser clipboard and download APIs

We do not operate a “upload photo → server returns angle” API for the core protractor tool.

What still leaves your machine

• Ordinary HTTPS page loads of HTML/JS/CSS/images that make up the site
• Optional analytics or feedback requests if you use those features
• Standard host/CDN security and access logs

Transport

Production should always be served on HTTPS for protractortool.com. Prefer modern browsers with current security patches.

Content Security

Deployment may include Content-Security-Policy headers (see project scripts/generate-csp-headers.mjs) to limit unexpected third-party script execution. If you self-host, keep CSP in sync when adding scripts.

Reporting issues

If you believe you found a security problem in ProtractorTool, use Feedback with a clear non-exploitative description, or contact the operator via About. Please do not upload private images into public bug reports.

Limits

No web tool is risk-free. Extensions, malware, or compromised devices can still observe browser activity. Treat this protractor tool as a productivity utility, not a secure vault for sensitive imagery.