Trust boundary

Safety and privacy

Theme creation, import parsing, validation, and contrast checks run in your browser. The site treats every pasted string as data, never as executable code.

What the site does

Limits paste length and validates known fields, colors, fonts, and variants.
Writes to the clipboard only after an explicit click and provides a manual fallback.
Keeps creator values in the current browser session; theme and font values are excluded from analytics.

What the site does not do

No eval, Function constructor, pasted-script execution, or hidden upload.
No account is required for the MVP.
No Dream Skin installer or instruction to bypass platform protections is provided.

Compatibility boundary

Contract validation is not the same as manual verification in every Codex Desktop build. Public OpenAI documentation reviewed 2026-07-17 did not establish a stable codex-theme-v1 import contract, so theme pages disclose that limitation.

Read the safe installation guide