What your browser enforces
Clickjacking
Other sites cannot embed this page in a hidden frame.
File sniffing
The browser trusts the real file type, not a disguised one.
Device access
Camera, microphone, location, and payment access are turned off.
Referrer
Leaving this site does not send the full page address along.
Third-party scripts
Meta, TikTok, and Snap load after the page paints. The page can be read without them.
HTTPS
On the public domain, browsers are told to stay on HTTPS.
A researcher can also read the contact file at /.well-known/security.txt. That is the standard place large sites publish a security contact.
What happens to a brief
The form posts the note to the studio API. It is stored in the studio database and a private spreadsheet. A hidden field catches automated spam and stores nothing. The Email button still opens your own mail app if you would rather not use the form.
Email the studio directly if you would rather not use the form. For private work, ask for an NDA before sharing logins, analytics, or customer data.
How client work is handled
The person you write to is the person who builds. Repositories for a paid project stay private. Access granted for a launch is removed at handoff unless you ask to keep a retainer. Two projects run at a time, so a brief is not passed down a bench of juniors.
What this page does not claim
There is no rented trust badge and no certification listed here that the studio does not hold. Security on a marketing site is the browser policy, the absence of trackers, and a careful intake. A production system for your company gets its own threat model during the engagement.
To report a problem with this website, email [email protected] with the subject “Security”.