Privacy Policy

The short version: your files never leave your browser

Files you drop or paste, parsed rows, generated SQL, CSV, Markdown, and JSON, and preview search terms are processed entirely in your browser (including in a Web Worker on the page). We do not collect, store, or transmit this payload — not to our servers, not to hosting storage, and not to advertising networks. There is no business-data table on our side, because the contents never reach us.

Who is responsible for your data

The data controller for this site is the operator of PrivateDataForge / xkjson.com. For any privacy question or request, contact privacy@xkjson.com. General support is at support@xkjson.com.

What we actually collect

Only two narrow categories of data ever reach us:

• Account data (optional). If you create an account, our authentication provider (Supabase) stores your email address, a password hash or Google OAuth identity, and your username. You may optionally sign in with Google.
• Preferences (optional). Your workspace mode and SQL dialect, so they carry across devices.

We never collect your file bytes, table rows, cells, generated SQL / CSV / Markdown, or preview search terms. Those are not uploaded because they never leave your device.

Cookies and similar technologies

We group cookies and local storage into three categories. Today only necessary cookies are active; analytics and advertising are described below and will apply only once we enable them.

Visitors in the EU, EEA, and UK — and anyone whose country we cannot determine — see a cookie bar where you can Accept optional or Reject optional. Optional analytics and advertising stay off unless you accept. Accepting does not send your files, tables, or SQL anywhere, and does not currently load any ad script.

Analytics and advertising once enabled

We plan to use Google services for measurement and to keep the site free. When enabled, and only after consent where required, the following will apply:

• Google Analytics may set cookies and collect usage data such as pages viewed and approximate region.
• Google AdSense and its partners may use advertising cookies (including the DoubleClick cookie) to serve and personalize ads, and to measure ad performance.
• Google may use information collected to personalize ads on this and other sites. You can review how Google uses data from partner sites at policies.google.com/technologies/partner-sites.
• You can opt out of personalized advertising in Google Ads Settings and manage other providers at aboutads.info/choices.

Even when ads are enabled, ad networks will not receive your file bytes, table rows, search terms, or generated output. Ads appear only in page chrome.

Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract to provide the account and workspace you request; our legitimate interests in keeping the service secure and understanding aggregate usage (balanced against your rights); and your consent for optional analytics and advertising cookies, which you may withdraw at any time.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email privacy@xkjson.com. You can also delete your account data by asking us. Because we never receive your files, there is no payload for us to delete.

Retention

Account and preference data are kept while your account exists and deleted on request. The pdf_consent cookie lasts up to 180 days. Analytics and advertising data retention will be governed by the relevant Google settings once those services are enabled.

International transfers

We use Cloudflare for hosting and Supabase for authentication, and Google services once enabled. These providers may process data in countries other than yours, including the United States, under their own safeguards such as standard contractual clauses. Your file contents are not part of these transfers because they never leave your browser.

Children

This service is not directed to children. It is not intended for anyone under 13 (or under 16 where local law sets that age), and we do not knowingly collect their data.

Third-party links

Our pages may link to third-party sites, such as Google's ad settings. We are not responsible for their content or privacy practices; please review their policies.

Changes to this policy

We may update this policy as the product evolves, for example when analytics or advertising are enabled. We will revise the effective date above and, for material changes, provide a clearer notice on the site.