Directing and production
1st AD, 2nd AD, UPM, line producer, production manager and production coordinator, who build and control the schedule.
From screenplay to the end of the shooting day, in one local-first space
PalaFilm Movie Management is an operating system for planning and coordinating film and television productions. It brings together the screenplay, the breakdown, the stripboard, scheduling, production paperwork, set execution, DIT, timekeeping, compliance, costs and data recovery.
The application runs in the browser, keeps the project on its users' own computers and needs no central database. The production authority issues signed invitations and certificates for each device, and selective synchronisation distributes only the areas a role is allowed. Any computer can become an active replica, an encrypted mailbox node or a permanent backup node.
Local-firstOffline PWACRDTWebRTC P2PAutomatic signalingRelay E2EEDigital signaturesMulti-node backupWCAG 2.2 AA ready
1Who it is built for
Departments
Coordinators, department heads, locations, transport, wardrobe, make-up, props and the crews who receive work orders and daily packets.
Set and image
Set, camera and DIT teams tracking scenes, takes, incidents, cards, rolls and verified copies.
Administration
Payroll, legal, insurance and accounting, tracking timecards, documents, POs, invoices, petty cash and cost reports.
2The problem it solves
A production's information is usually scattered across the screenplay, spreadsheets, calendars, PDFs, messages and separate applications. PalaFilm uses a single project as the operational source: one scene change can update revision impact, the schedule, assets, the call sheet, work orders, risks and reports. The aim is less manual re-entry and a verifiable trail of decisions.
1operational project
Screenplay, scheduling, production, actuals and documents in one unified model.
0mandatory central databases
Project data stays on the devices the user chooses.
E2EEbetween devices
Direct messages use session keys and application-level encryption.
A4 / XLSX / CSVprofessional handoff
Controlled documents and portable data for production and accounting.
3Functional modules
| Area | What it covers |
|---|---|
| Screenplay and revisions | Screenplay import and writing, a focus mode, a centred writing page between two hideable rails (scenes and details) with the elements indented as they print, a Pages view that lays the screenplay out exactly as the PDF prints it, a page that scales itself to Full HD, 2K, 4K, 6K and 8K screens, keyboard shortcuts for moving between modules and scenes (listed under ? and in the command palette), dual-dialogue pairing and heading suggestions, scene headings, estimated pagination, elements, snapshots, comparison, revision impact, bulletins, receipts and revised sides. |
| Story | An outline board of scene cards grouped by act or sequence, which you can drag between acts or move with the keyboard, with structure templates, a character rename that follows the script, the cast entry and the notes (also when the cast entry is renamed in Elements), shooting days for every character and set taken from the schedule, open questions that show on the stripboard and in the Cockpit, an outline that revisions remember and compare, a printed outline, bible and notes, a Fountain export that carries sections, synopses and open notes, notes, to-dos and questions, a character and location bible with profiles, and an analysis of pacing, dialogue share, presence, story days and structure. |
| Breakdown and assets | Scene breakdown, an asset catalogue with owner, vendor, quantity, rate and status, daily continuity, duplicate merge, and Missing/Damaged risks. |
| Scheduling | Stripboard, boards and units, calendars, non-working days, cast and location availability, DOOD, scene locks, auto-scheduling, the optimizer and variant comparison. |
| Intelligence & Control Tower | Schedule Health, estimated pages and hours, company moves, conflicts, costs, three isolated proposals, and decisions that preserve days already shot. |
| Production Office | Call Sheet Control with immutable versions, department readiness, work orders, daily dispatch, department packets and Revision Distribution Control. |
| Live Set & DPR | Start, meal and wrap, per-scene status, take log, camera and sound rolls, delays, safety, incidents, decisions, DPR and actuals. |
| DIT & Media | Cards and volumes, SHA-256 computed from the files, copy verification, camera and sound roll continuity, backup status and editorial handoff. |
| Crew Timecards | Timekeeping, shifts across midnight, overtime, meal penalties, turnaround, approvals, gross cost and payroll export. |
| Compliance | Permits, insurance, contracts, expiry dates, owners, alerts, and integration with readiness, the Risk Heatmap and the Call Sheet. |
| Accounting | PO approval workflow, invoices linked to PO and category, disputes, petty cash, reimbursements, budget-to-actual reconciliation and a weekly cost report. |
| Mobile & Offline | A touch interface for phone and tablet, an installable offline PWA with app shortcuts and file opening from the system, autosave, IndexedDB, a synchronisation queue and conflict resolution. |
| Focus Experience | The Today page, an Action Center ordered by priority, navigation in five zones, and tools focused automatically for Owner, Producer, Production Manager, 1st AD, Department Head, Crew and Viewer. |
| Guided Production | A measurable flow in seven stages — Setup, Screenplay, Breakdown, Schedule, Readiness, Shoot and Deliver — with the next step recommended automatically and a contextual inspector for the stage, screen, scene or shooting day. |
| Intelligent Command | Natural-language commands in Romanian and English (the interface itself can be shown in English, Romanian or German), turned locally into verifiable plans, with preview, role validation, explicit approval, undo, a journal, and conditional automations that synchronise. |
| UX Self-assessment | A WCAG 2.2 AA self-assessment, skip navigation, focus management, screen-reader announcements, contrast, text and motion preferences, 44 px touch targets, reflow at 320 px, and a controlled user-testing protocol. |
| Chromatic Line Interface | A platform-neutral visual system of its own: fine structural lines, contextual colour for Setup, Plan, Shoot, Deliver and Control, light surfaces, text at verified contrast, and the same hierarchy adapted to desktop, tablet and phone. |
| Adaptive Workspace Layout | Screen architecture fitted to the task: a compact overview for decisions, a wide register for data, and a fluid canvas for screenplay, stripboard and live operations. The topbar separates state, files and assistance, and components respond to the width actually available. On a desktop screen the left menu and the top menu can each be hidden with a small tab on its edge, or from the command palette; the work then uses the width and height they free, and the choice is remembered on that device. |
| Team & Access | Optional local accounts, salted and hashed PINs, roles, a user session, activation and deactivation, and device authorisation. |
| Distribution Center | Controlled packages, a document snapshot, SHA-256, an ECDSA signature, a recipient register, email and WhatsApp, E2EE transfer and acknowledgements. |
| Production Mesh | A local production authority, signed QR invitations, device-bound certificates, roles and scopes, revocation, selective CRDT and automatic reconnection within the active session. |
| Distributed Approval & Quorum | A per-project policy for critical actions, signed proposals, one vote per authorised device, a configurable threshold, expiry, revocation, and deterministic transactional commit for Board Lock, Call Sheet, PO and invoices. |
| Secure Collaboration Gateway | A temporary invitation by link, automatic WebRTC signaling, online presence, reconnection, and relay for envelopes that are already encrypted and signed. The gateway holds no projects and no keys. |
| Security Assurance | Technical checks mapped to ISO 27001, SOC 2 and OWASP ASVS, ECDSA-signed evidence export, a CycloneDX SBOM and an event journal. Formal certification requires an independent audit. |
| Integration Hub | Microsoft Teams, Slack, Discord, Zapier, Make, n8n and a generic HTTPS webhook through server-side connectors; open ICS export for calendars and JSON for automations. |
| Security and recovery | ECDSA, ECDH, AES-GCM, replay protection, an asynchronous mailbox encrypted for the recipient alone, permanent backup nodes, retention and approved recovery. |
4Local-first architecture
1 · Local browserThe current project, recovery points, journals and settings in IndexedDB and localStorage.
2 · CRDT replicasSigned operations that converge deterministically across authorised devices.
3 · Direct channelWebRTC with an encrypted session; STUN can only help discover a route.
4 · Optional gatewaySignaling, presence and volatile relay for opaque E2EE envelopes.
5 · NodesStore-and-forward E2EE mailboxes and encrypted backup snapshots on chosen computers.
BroadcastChannel synchronises windows on the same origin. Between computers, a temporary link carries the room capability and pins the initiator's cryptographic fingerprint. The gateway exchanges signed WebRTC offers automatically; if the direct route does not open, it forwards the same AES-GCM envelopes without receiving the key or the content. QR and text codes remain available for fully offline pairing. For members who are away longer, an authorised mailbox node can hold the encrypted envelope until they reconnect.
Web distribution: publish the release to a static HTTPS host, Cloudflare Pages included, with tools/publish-dir.cjs, which copies only the files listed in deploy/publish-manifest.json and leaves out the tests and the build tools. The package contains the local application, the documentation and the development tests. The Sync, AI and Collaboration Gateway services need a separate, compatible and authenticated backend. This distribution does not include a gateway/server.mjs server. See the guide in the package for the integration contracts.
5The security model
| Control | Implementation | Role |
|---|---|---|
| Device identity | ECDSA P-256, non-exportable private key | Signs handshakes, operations and backup manifests. |
| Session key | Ephemeral ECDH P-256 | Generates a new key for every pairing. |
| Transport encryption | AES-256-GCM at application level, over WebRTC or relay | Confidentiality, integrity and message authentication. |
| Gateway | Capability rooms, volatile retention and size limits | Automates rendezvous and can route signed ciphertext only. |
| Supply chain | CycloneDX SBOM, SHA-256 manifest and ECDSA attestation | Inventories the components and blocks unauthorised changes to the distribution. |
| Integrations | Session token, server-side connectors, HTTPS, SSRF protection and HMAC | Keeps platform secrets out of projects and signs generic webhooks. |
| Distributed operations | Signed CRDT and a Lamport clock | Identifiable authorship, deterministic merge and tombstones. |
| Production authority | ECDSA certificates bound to device, role and scope | Controls who joins the project, what they receive, and how access is revoked. |
| Asynchronous mailbox | Ephemeral ECDH + AES-256-GCM + sender signature | The intermediate node stores ciphertext and cannot read the content. |
| Trust | TOFU through physical QR pairing | Pins the fingerprint of the first key and blocks unexpected changes. |
| Backup at rest | AES-256-GCM with a non-exportable local vault | The replica is never left in the clear in the node's store. |
| Audit | SHA-256 hash chain and local events | Reveals tampering with the journal, and security incidents. |
Legal boundary: digital signatures identify devices and protect the integrity of PalaFilm operations. They are not qualified electronic signatures, and the application is neither a public blockchain nor a certification service.
6Backup and recovery
On a desktop Chromium browser (Chrome, Edge) the Storage screen can also keep an automatic copy of the open project, with the last ten versions, in a folder you choose, such as a synced or external drive. It needs your permission again after each browser session, is not encrypted and is a convenience, not a replacement for the checks below.
- A trusted computer is enabled from System → Backup Nodes.
- Devices are paired by QR, and the node announces its capability on the authenticated channel.
- Durable saves can generate a replica automatically: the complete project plus the signed CRDT history.
- The node verifies the manifest and the hash, then encrypts the replica with its own vault key.
- A new computer requests the catalogue and the recovery; the node's operator approves the transfer explicitly.
- Before restoring, PalaFilm verifies the signature and the hash and creates a checkpoint of the current project.
- Optionally, the node can hold E2EE mailbox envelopes for offline members and deletes them once delivery is acknowledged or retention expires.
For an important production, at least two nodes on different computers and different physical media are recommended, plus periodic .PALA exports. Clearing the site's data destroys the local keys and can make copies encrypted with that vault alone unrecoverable.
7Reports and documents
The print engine produces A4 documents, portrait or landscape, with control metadata, numbering and logical pagination. They include, among others: Shooting Schedule, One Line Schedule, Call Sheets, Breakdown Sheets, DOOD, Locations, Crew, Budget Top and Detail, Cost Reports, DPR, Executive Summary, Risk Heatmap, Department Readiness, Asset and Continuity, Work Orders, Daily Dispatch, Department Packets, Revision Impact and Bulletin, Revised Sides, Live Set Log, Camera Report, DIT and Editorial, Timecards and Payroll, Compliance and Accounting.
The XLSX workbook and the CSV exports provide handoff for scheduling, departments, payroll, editorial, compliance and accounting. Report templates can be saved with the project for reuse.
8File formats
| Format | Import | Export | Notes |
|---|---|---|---|
.pala / JSON | Yes | Yes | The complete, portable PalaFilm project format. |
.msd | Yes | Experimental | Movie Magic Scheduling; the export must be validated in the target application and the original kept. |
.fdx | Yes | Yes | Final Draft screenplay. |
.fountain / text | Yes | Yes | An open screenplay format. |
.pdf | Yes | Print / Save as PDF | Import needs a PDF with text; scans without an OCR layer cannot be read. |
.xlsx | Yes | Yes | Assisted tabular import and a multi-sheet operational workbook. |
.csv | No | Yes | Specialised UTF-8 exports for modules and handoff. |
.palax | Yes | Yes | A portable project backup, encrypted with a password. The password cannot be recovered: without it the file stays unreadable. |
.paladist | Yes | Yes | A signed distribution package, limited to the scope chosen for its recipients. The signature is verified before it is accepted. |
.ics | No | Yes | The shooting-day calendar, for import into a calendar application. |
| Handoff JSON | No | Yes | A structured export for another system, from the Integration Hub. Separate from the project format. |
.html | No | Yes | The day packet from the Production Cockpit. It is a fixed copy: it does not update after it is issued and must be regenerated after any revision. |
9Optional AI
The deterministic scheduling engine and every core function work without AI. AI is optional and is used for explanations and recommendations in the Control Tower and Production Dispatch, to propose plans in Intelligent Command, which PalaFilm checks step by step before you approve them, and, when switched on, to suggest breakdown elements for one scene at a time, each backed by a quote from the scene. Nothing is contacted until someone connects a provider in System → AI Connector.
- Direct, with your own key: OpenAI (ChatGPT), Claude (Anthropic), Google Gemini, Mistral, xAI (Grok), DeepSeek, Groq, OpenRouter, Perplexity, Cohere and Together AI. The connector opens the provider's key page, loads the models the key may use and runs a one-word test with no project data before it connects.
- Sign in with OpenRouter: an authorization-code sign-in with PKCE that returns a key without pasting one.
- Through a gateway: Microsoft 365 Copilot, which needs Microsoft Entra sign-in, and any provider an organisation prefers to reach centrally.
A key is kept in page memory for the session only and is never written to storage or to a project. The page's security policy allows connections to these eleven provider addresses and no others. Requests are billed by the provider, under the provider's own terms; see the Privacy Policy and the Terms of Use.
10Requirements and known limits
- A modern browser with IndexedDB, Web Crypto, Service Worker and, for peer sync, WebRTC is required.
- The camera for QR scanning needs HTTPS or
localhost; entering the code by hand remains available. - The application works offline once the PWA shell has been loaded and stored by the browser. Installing it is optional; the Install button appears only where the browser offers it, and opening project or screenplay files from the system needs a Chromium-based desktop browser such as Chrome or Edge. Elsewhere, use the Import button.
- The Secure Collaboration Gateway must be online for signaling, presence and relay. Its rooms and messages are volatile and disappear on restart; it does not replace permanent backup or mailbox nodes.
- Gateway invitations expire after 10 minutes. The relay is for operational synchronisation; large permanent-backup transfers still use the direct WebRTC channel.
- A backup or mailbox node must be running and connected to receive new copies or messages; it is not a cloud service operated by PalaFilm.
- The browser decides whether to grant persistent storage. External exports and multi-node redundancy remain necessary.
- Time, cost, payroll and compliance calculations and scheduling suggestions are decision support and must be checked professionally.
- Version 0.x is a suite under development; experimental compatibility and critical workflows must be validated before anything is issued officially.
Current release · 1.7.1 — Production Studio. The 0.93 releases reorganised the code without changing what the application does: interface code moved out of the domain layer, the longest view functions were split, one spacing style and shorter template lines were applied, and each step was checked to leave the behaviour unchanged. This release, 1.7.1, adds public product pages in English, Romanian and German at pm.palafilm.com, opens them, the function guide and these legal pages to search engines and AI assistants (sitemap, canonical addresses, language alternates, structured data, llms.txt), and keeps the application itself out of search. Release 1.7.0 simplified the structure: the navigation has one entry per working question (17 instead of 43), the related pages are tabs under the page title, Focus shows each role the five to eight entries it works in every day, and the production flow names only the stage in hand. Release 1.6.2 exported the screen in use: the Export menu prints its report as PDF (on Call Sheets the call sheets, on DOOD the Day Out of Days) or saves a PNG picture of the whole screen, made in the browser. Release 1.6.1 switched language with three flags in the application, the legal pages and the guide, and brings the Privacy Policy, the Cookies page and the Accessibility statement up to date. Release 1.6.0 printed schedules, call sheets, breakdown sheets and the Day Out of Days in the form productions use: cast ID numbers, standard strip colours, End of day lines, the advance schedule, the breakdown form with its category colours, and A4 or US Letter. Release 1.5.0 added Build my production: a guided path in five steps from a screenplay, or a sample film, to a priced shooting plan and the call sheet of day 1, each step shown and confirmed before it changes the project. Release 1.4.8 opened in the browser language on a first visit, continues a project on the screen it was left on, puts the shooting day before model notices, adds opt-in reminders on this device and a record of use that never leaves it. Release 1.4.7 made notices readable in dark mode, keeps the More menu and Ask PalaFilm usable on a phone, and runs the browser tests in parallel with a time limit per test. Release 1.4.6 wrote amounts and numbers the way the chosen language does, gathers the occasional tools of the top bar in a More menu and brings the function guide up to date with the cast-day totals and Undo. Release 1.4.5 completed the Romanian and German translation of every screen and notice, adds the days of each performer (work, hold, travel, total) to the Day Out of Days and makes the interface calmer: notices stay long enough to read and offer Undo after a removal or a move. Release 1.4.4 translated the printed reports (PDF) and the column names of the Excel and CSV exports into Romanian and German, the fifth and last stage: dates follow the chosen language and the project's own data stays as typed. Release 1.4.3 translated the function guide into Romanian and German, the fourth stage: it opens in the language chosen in the application and has its own language switch. Release 1.4.2 translated the System screens, the notices and the browser dialogs into Romanian and German, the third stage: every screen of the application now speaks both languages. Release 1.4.1 translated the Shoot, Deliver and Control screens. Release 1.4.0 translated the Today, Project and Planning screens into Romanian and German, the first of several stages; what you type and the names in your project are never translated. Release 1.3.10 gave the function guide the design of the legal pages: the same font, colours, light and dark themes, top bar, cards, tables and footer. Release 1.3.9 made PalaFilm open several times faster on a real connection: each part of the application is downloaded once and in parallel instead of twice and one after another, and is still checked against the signed release before it runs. Release 1.3.8 fixed the Stripboard on screens about 1280px wide, where the buttons of each day covered the day title: they now move to a second row when they do not fit. Release 1.3.7 brought the installed app in line with Studio: an icon whose mark can be seen, four install screenshots of the current screens, Cockpit, Stripboard, Script and Live Set in the jump list, and window colours that follow the light and dark themes. Release 1.3.6 completed the Studio redesign: every screen reads its figures as one strip, the System and remaining Today screens follow, and the dark theme now passes WCAG AA contrast throughout. Release 1.3.5 brought Budget, Accounting, Reports and Distribution into Studio: one line per budget category, the budget figures as one strip, and report cards without a wall of filled buttons. Release 1.3.4 brought the Shoot screens into Studio: figures read as one strip on every screen, Live Set keeps its day cycle on one row with one filled button, and Call Sheet Control lists the days as compact rows. Release 1.3.3 gave large 44 px touch targets automatically to touch screens and makes them a choice with a mouse, which makes every screen denser on a desktop, and tightens Script and Story. Release 1.3.2 made the Stripboard denser: one line per scene, one row per day header, one filled button on the screen, and a layout that keeps the strips readable on tablets. Release 1.3.1 rebuilt the Production Cockpit around the next shooting day: its forecast, its scenes and the day packet come first, what to do next and what blocks filming sit beside them. Release 1.3 began the Studio redesign: one accent colour across the whole application, a quieter top bar, the production flow in one row instead of a block, nothing in the frame under 11 px, and two screens that no longer run past the window; what each screen does is unchanged. Release 1.2 measured the AI features: AI Connector shows every request each project sent, how long it took, the tokens the provider reported, the cost at the prices you enter and how each plan ended (applied, undone, not applied), numbers only and kept in this browser; Model & Confidence shows how well the overrun forecast has done, each filed day forecast again from the reports before it. Release 1.1.1 closed the findings of a security audit of the AI features: shortcuts no longer send anything to an AI provider without saying what and to whom, AI suggestions arriving by sync or import keep only their own shape, a direct key goes only to its own provider, and project text is marked as data for the model. Release 1.1 connected these features to each other: a day likely to run over appears in Guided Production, the Action Center and Today, an automation can watch for such days, “fix day 6” in Intelligent Command and the command palette start the AI fix, and the palette reaches the AI plans, the breakdown suggestions and the accessibility statement. Release 1.0 let the AI correct a plan PalaFilm refuses, sending the reasons back at most twice, and adds Ask AI to fix Day N to the overrun forecast: the plan comes back with that day's forecast before and after, for approval like any other. Release 0.99 published the accessibility statement. Release 0.98 learns how long this production's whole days really run, from the call and wrap times of filed daily reports, and warns about the days still to shoot that look like the ones that ran over; it is computed locally and does not change the schedule estimate. Release 0.97 added AI breakdown suggestions: switched on in AI Connector, the AI reads one scene and suggests elements the local analysis misses, each with a quote that PalaFilm finds in the scene before showing it, for review like any other proposal. Release 0.96 let the connected AI provider propose plans in Intelligent Command: PalaFilm checks every step against the project and your permissions, shows the schedule before and after on a copy, and applies the plan only after approval, as one undoable change. Release 0.95 published the legal pages in Romanian and German, with a language switch on every page. Release 0.94 brought them up to date with the AI providers and gave them a new layout. Release 0.92 connected eleven AI providers directly, with your own key, and added Sign in with OpenRouter and a guide for each provider's key page. Release 0.91 translated the navigation, the top bar, the Cockpit and the start screen into Romanian and German. Release 0.90 regrouped the menu, with a System group for the ten technical modules. Release 0.84 connects the functions to each other: a rename or a removal in one screen reaches Story, and open questions and acts appear on the stripboard and in the Cockpit. Earlier releases added automatic backup to a folder, the Pages view, the Story workspace, the installable app and the Update now notice. A new release is still installed in the background and never replaces the one you are working in by itself. Estimation, scheduling and the optimizer are unchanged: day length is modelled per scene and calibrated against filed DPRs, and the condition multipliers remain declared assumptions you can edit or switch off. The application still starts with no project open, and the package ships a CSP for executables, verification of the essential resources before start-up, an ECDSA-signed SHA-256 manifest and a WebAssembly kernel for the optimizer's numeric scoring.
Distribution protection
The build verifies the release signature and the hashes of the essential resources before loading the engine. Lazily loaded PDF resources are verified before use. Any difference in content blocks start-up and shows the integrity error. The private release key stays outside the package; the distribution contains the public key only. WebAssembly moves the repetitive scoring formula for candidate schedules into a binary module, with a JavaScript fallback for compatibility.
Minification and obfuscation raise the cost of analysis, and code running in a browser remains inspectable by a determined adversary. The CSP blocks inline scripts, JavaScript attributes and eval. Since this release it also blocks inline style attributes: the values that used to be computed at runtime now reach the page as CSS rules or through CSSOM.
Digital Production Twin — use and limits
In Plan → Production Twin, define the scenario and the locks, run the simulation, then compare scenes, dates, costs and forecasts before and after. The dependency map links scenes to cast, locations, assets and departments. Live Set and DPR data feed the indicators without any mandatory call to an AI service.
Explicit approval archives the previous schedule, keeps the identity of the active board, creates work orders and an ECDSA-signed decision. Complete Call Sheets are issued or revised; incomplete ones are marked for review. Recipients are selected explicitly; signed notifications are prepared in the Distribution Center, not sent automatically.
The P10/P50/P90 ranges come from 256 Monte Carlo simulations with a fixed seed. With at least three usable DPRs, the pace is resampled from measurements; otherwise the average pace or the model and the configured uncertainty are used. These are estimates conditioned on data and assumptions, not calibrated probabilities or guarantees of cost and deadline. The conservative model includes overtime and a reserve of days for recovery. Unscheduled strips are not included.
Days that are reported or started, and scenes already shot, are never modified. Unfinished scenes on days with a filed DPR must be reconciled by hand before approval. Variants with critical errors, invalid integrity or a modified source are blocked. CRDT synchronises decisions as distinct entities, but concurrent offline approvals of the same board need operational review; there is no distributed transaction and no blockchain consensus.
11Publisher
Administrative details: the operator's identity is filled in for this release. For commercial publication, the legal documents must be kept in step with the operator, the hosting and whichever optional services are configured.
| Operator | Catchwave SRL |
|---|---|
| Country | Romania |
| Registered office | Str. Lavei nr. 27, Sector 5, Bucharest 052765, Romania |
| Trade Registry no. | J40/17036/2020 |
| CUI | 43433687 |
| Contact | contact@palafilm.com |
12Open-source components
The components are included locally in the package; using them does not by itself cause requests to an external CDN.
PDF.js
| Component | PDF.js (pdfjs-dist) |
|---|---|
| Version | 6.2.108 |
| Publisher | Mozilla Foundation and the PDF.js contributors |
| License | Apache License 2.0 |
| Project | mozilla.github.io/pdf.js |
| License text | vendor/pdfjs/LICENSE |
| Use | Extracting text and structure from screenplay PDFs. |
qrcode-generator
| Component | qrcode-generator |
|---|---|
| Version | 2.0.4, commit 83b7e8fe3fddd3b0368dbafd6ce56995bd25e3c8, unmodified source |
| Publisher | Kazuhiko Arase |
| License | MIT License |
| License text | vendor/qrcode/LICENSE |
| Use | Local, offline generation of the QR codes used for WebRTC pairing. The PalaFilm adapter (vendor/qrcode/pala-qrcode.js) is our own code, kept separate from the upstream source. |
DOMPurify
| Component | DOMPurify (dompurify) |
|---|---|
| Version | 3.4.15, unmodified source |
| Publisher | Cure53 and the DOMPurify contributors |
| License | Apache License 2.0 or Mozilla Public License 2.0, at the user's choice |
| License text | vendor/dompurify/LICENSE |
| Use | Sanitising every markup insertion in the interface, through PalaHTML.setHTML. |
Inter
| Component | The Inter font family |
|---|---|
| Publisher | The Inter Project Authors |
| License | SIL Open Font License 1.1 |
| License text | vendor/inter/LICENSE |
| Use | The interface font, shipped locally as woff2. No font is loaded from an external CDN. |
The SHA-256 hashes and Git blob SHA-1 hashes for the upstream sources and their license texts are in security/upstream-provenance.json; the complete inventory is in security/sbom.cdx.json.
Apart from the components listed here, the application is built in HTML, CSS and JavaScript, with no UI framework.
13Trademarks and independence
Movie Magic and Movie Magic Scheduling are trademarks of Entertainment Partners. Final Draft is a trademark of Final Draft, Inc. OpenAI, ChatGPT, Claude, Anthropic, Google, Gemini, Mistral, xAI, Grok, DeepSeek, Groq, OpenRouter, Perplexity, Cohere, Together AI, Microsoft and Copilot are trademarks of their respective owners and appear only to describe compatible connectors. Catchwave SRL is not affiliated with, endorsed by or sponsored by these companies.
14Legal documents
- Privacy Policy — local processing, device pairing, optional AI providers and the backup nodes.
- Terms of Use — professional responsibilities, compatibility and limits.
- Cookies & Local Storage — the inventory of mechanisms and keys stored in the browser.
- Accessibility Statement — what has been checked, the known limits and how to report a barrier.