# Pages you open

> Why a note can't run code or phone home by default, what the two per-vault switches change, and how links leave the app.

Source: https://docs.docgraph.app/privacy/pages/

An HTML note can carry more than text: scripts, tracking pixels, fonts and images hosted somewhere else. A page pasted from the web or saved from an email usually does. DocGraph shows the text and keeps the rest from running or loading, until you decide a vault is trustworthy.

## Getting there

**Settings → Privacy → Page scripts.** Both switches are **per vault** and both are **off** by default.

*[Screenshot: The "Page Content & Scripts" pane with two switches for this vault, both off: "Allow scripts in this vault" and "Allow remote content in this vault".]*

| Switch | Off (default) | On |
|---|---|---|
| **Allow scripts in this vault** | `<script>` in your pages is removed before the page is shown. DocGraph's own features — tables, charts, the editor — work either way. | Pages run their own scripts, still inside a sandbox with no access to the app or your other files. Pages with scripts become read-only in place; edit them in `<>` **Source**. |
| **Allow remote content in this vault** | Images, fonts, stylesheets and anything else from the internet are blocked, so a note can't silently report that it was opened. | Pages load remote images, fonts, stylesheets and other resources — and, if scripts are also allowed, can contact the internet themselves. |

The two are independent: a tracking pixel needs no script.

## When something is blocked

You're never left guessing why a page looks unfinished. When a page contains scripts that aren't running, or DocGraph blocked remote resources on it, a notice appears above the page — and the toolbar shows a **Scripts off** reminder:

*[Screenshot: A saved partner newsletter open in DocGraph. Two notices above it: "This page contains scripts that aren't running…" with an "Allow scripts…" button, and "Blocked 2 remote resources (image, font, or stylesheet) on this page…" with an "Allow remote content…" button. In the page, a remote image shows its alt text "Coastline photo blocked — remote resources are off by default".]*

A notice only appears when there is something to act on. A page without scripts never shows the scripts notice, and the remote-content notice counts what it actually blocked.

### Allowing scripts

**Allow scripts…** asks first, and is explicit that the decision covers the whole vault:

*[Screenshot: A confirmation: "Allow scripts for this whole vault? Pages in this vault will be able to run their own script code — this applies to EVERY page in the vault, not just this one, until you turn it off. Only enable it for a vault whose content you trust. Pages stay sandboxed: no access to the app or other files — and no access to the internet unless you also allow remote content." Buttons: Cancel, Allow scripts.]*

### Allowing remote content

*[Screenshot: A confirmation: "Allow remote content for this whole vault? Pages in this vault will be able to load remote images, fonts, stylesheets and other resources (http/https) — and, if scripts are also allowed, contact the internet themselves. … Remote content can silently report when and where a note is opened (tracking pixels) — only enable it for a vault whose content you trust." Buttons: Cancel, Allow remote content.]*

Unlike scripts, allowing remote content does not make pages read-only.

### Before you click

- **There is no per-page allowance.** Both switches cover the whole vault. If you trust one page but not the rest, keep them off.
- **The notice's ✕ is permanent for that vault.** Dismissing means "stop telling me about this vault", not "hide this once", and there is no in-app way to bring it back. The **Scripts off** reminder in the toolbar stays; there is no equivalent reminder for remote content, so a dismissed vault blocks it silently from then on.
- **Allowing remote content re-admits plain `http`** for those resources.
- **A page with an [encrypted passage](https://docs.docgraph.app/privacy/encryption/#encrypt-one-passage) never runs scripts**, even with **Allow scripts in this vault** on, so its code can't read the passage once you unlock it.

## Links

Clicking a link to a website opens it in your **normal browser**; the note itself never navigates away. Only `http`, `https`, `mailto`, `tel` and `sms` links are let through — anything else is refused. There is **no confirmation**: one click and your browser opens.

A link you type or paste into a note is refused if it uses `javascript:`, `vbscript:`, `data:` or `file:`.

Related: [Recipes → I open HTML saved from the web](https://docs.docgraph.app/privacy/recipes/#i-open-html-saved-from-the-web)