- Make the privacy promise true: bundle the fonts (Poppins/Inter/JetBrains Mono
latin subsets + the text-security mask font) under helwasm/assets/fonts/ and
drop the Google Fonts + jsDelivr links. The page now makes zero external
requests once loaded — it talks to no third party.
- Say it plainly throughout the UI: a "Private by design" callout in the About
panel, the meta description, the quick-gen and console hints, and the footer —
nothing you type leaves the browser, no server, no account, no tracking.