Hosts, privacy and browsers

Hosts, privacy and security

• Requests go to https://api.iconavo.dev, https://cdn.iconavo.dev, https://cdn2.iconavo.dev and https://iconavo.b-cdn.net, in this order, and to the next host only if the previous one fails. They are plain GET requests for icon data, without cookies.
• Nothing is stored in the browser: no cookies, no localStorage, only the browser's HTTP cache.

• Content Security Policy. With a strict policy, allow:

  connect-src https://api.iconavo.dev https://cdn.iconavo.dev https://cdn2.iconavo.dev https://iconavo.b-cdn.net;
  script-src https://cdn.jsdelivr.net;
  trusted-types iconavo;

  script-src is needed only for the script tag, and trusted-types only if you enforce Trusted Types.

• Trust. Icon data becomes part of your page as SVG markup. Load icons only from hosts, files and loaders that you trust as much as your scripts.

Browsers and frameworks

• The last two versions of Chrome, Edge, Firefox and Safari.
• ES modules only; there is no CommonJS build.
• React 18 and 19, including the Next.js App Router.
• Size, gzipped: the tag with its core is at most 7 KB, the React component with the core at most 7.5 KB, not counting React. CI fails if a change goes over.

License

The package code is MIT. The icons keep their authors' licenses:

The full texts are in the data folder and in the @iconavo-ui/icons-{set} packages.

Edit this page on GitHub