3D models are stored in R2 and shown via the separate viewer embed (obfuscated pur1 blob) — this adds friction but a determined user can still recover bytes in DevTools/JS because browsers must download renderable data. Don’t upload source project files you need to keep private.
pur1