Privacy Policy & Zero-Upload Execution Guarantee

VRAMLab (vram.codeap.com, operated by CodeAP Studio) requires no accounts, collects no model weights or proprietary configuration files, and executes every calculation and binary header inspection inside your local browser tab.

1. Zero-Upload Local .gguf & config.json Inspection

When you select or drag a .gguf checkpoint or config.json into the GGUF Inspector, the browser reads only the local leading byte slice via File.slice() and DataView in volatile tab memory. Zero bytes of your weights, custom fine-tune names, or serving manifests are ever transmitted over the network.

The GGUF binary container stores all model metadata immediately after the 4-byte ASCII magic ("GGUF" / 0x46554747), 32-bit version integer, 64-bit tensor count, and 64-bit KV pair count—well ahead of multi-gigabyte quantized tensor blocks. By slicing only the first 16 MiB with the browser File API, VRAMLab decodes UTF-8 keys, typed scalars, and tokenizer array lengths without reading tensor payloads.

For FP16, BF16, FP8, or AWQ checkpoints distributed as safetensors shards, dropping the accompanying config.json extracts hidden_size, num_hidden_layers, num_key_value_heads, kv_lora_rank, n_routed_experts, and sliding_window_pattern so you can size vLLM or SGLang clusters before downloading hundreds of gigabytes of weights.

2. Static Edge Delivery & Local Storage Controls

All pages on vram.codeap.com are served as static assets with strict Cross-Origin-Resource-Policy: same-origin and frame-ancestors 'none' headers. Optional theme and language preferences are stored locally via codeap_color_scheme and codeap_lang, alongside aggregate page-view telemetry via Google Tag Manager (GTM-N64WPS2P) that never captures tool inputs.

2. Static Edge Delivery & Local Storage Controls
Control / Header Active Policy Value Scope
File.slice(0, 16777216) Local ArrayBuffer + DataView (0 bytes uploaded) .gguf & config.json
Cross-Origin-Resource-Policy same-origin (HTML/JS/CSS) · cross-origin (icons/OG) vram.codeap.com/*
Content-Security-Policy frame-ancestors 'none' vram.codeap.com/*
Strict-Transport-Security max-age=31536000; includeSubDomains HTTPS Edge
X-Content-Type-Options nosniff vram.codeap.com/*
Permissions-Policy camera=(), microphone=(), geolocation=() Browser Sandbox
codeap_color_scheme localStorage / cookie (light | dark | system) Optional UI Theme
codeap_lang SameSite=Lax 1-year preference cookie Optional Locale Choice
GTM-N64WPS2P Aggregate page-view telemetry (zero file or model payload capture) Analytics