RenderWhy 1.0.0 · offline guide

Local processing and deliberate sharing

RenderWhy reads the scene already open in Blender. It has no network permission, telemetry, account, upload, licensing server or automatic update service.

What stays in memory

Snapshots contain original-ID references, names, paths, scalar controls and coverage. They are module-owned runtime state per window. They are not Scene/Object custom properties and are not written into your .blend. Load/undo/redo/unregister invalidate runtime references. The extension does not read your clipboard or scan library files.

Each export starts with name removal enabled

Export HTML, Copy Report and diagnostic reference formatting use one semantic privacy pipeline. Scene, layer, object, collection and library labels are replaced by identity-keyed aliases before headings, explanations, paths and native guidance are formatted. One shared Collection keeps its alias across occurrences and layers; distinct identities remain distinct even with identical display names.

Each operation has a fresh preview and Replace all project names with aliases enabled by default. You can explicitly turn it off for that operation. Intended names are then escaped as text; source/library/export paths, operating-system usernames, runtime tokens, reverse maps and raw exception messages are still omitted. Path-looking user labels may appear only if you deliberately include names; they never trigger a filesystem lookup.

This is name removal, not irreversible anonymization. Scene structure, path counts, flags, frame and relationships remain and may still be recognizable. Inspect the preview and report before sharing.

Files and clipboard

Files permission supports deliberate local HTML export and bundled documentation. Clipboard permission is used only for explicit Copy Report after preview; the clipboard is never read. A report is UTF-8, contains no JavaScript, remote fonts or external resource loads, and cannot execute a property reference.

Export Report first opens the native file chooser. Choosing a destination writes nothing: the original target and layer pair are recaptured afterward, then a fresh privacy preview appears with name removal enabled. Confirm Save report for a new file, or Continue to replace followed by the separate Replace Existing Report confirmation for an existing file. Cancel preserves existing bytes. Copy Report and Copy Control Reference show a fresh preview directly, without a file chooser.

Report generation is bounded before writing. A temporary sibling is flushed and atomically replaces a regular destination on success. Symlink destinations are refused. Cancel and generation/write failure preserve the prior destination or clipboard. Filesystem crashes and future operating systems require separate evidence; no backup service is supplied.

Blender’s trust boundary

The extension does not execute scene scripts or change auto-execution trust. It cannot retroactively sandbox Blender or a malicious .blend, including drivers already executed by Blender under your trust settings.

This website

The static homepage and public synthetic samples have no analytics, forms, accounts, uploads, third-party runtime scripts or CDN assets. Ordinary hosting access logs may record requests, IP addresses and browser metadata under the operator’s server configuration. Do not upload customer data here; no upload endpoint exists. Seller/contact and hosting operational terms must be confirmed before publishing.