Privacy and data protection

Contents

1. Who runs this site
2. What we do not collect
3. What your browser stores locally
4. What leaves your browser, and when
5. The optional AI panel
6. Sharing links that carry data
7. The browser extension
8. Your rights under GDPR, UK GDPR and India's DPDP Act
9. Children
10. How to verify all this yourself
11. Changes to this policy
12. Contact

1. Who runs this site

JSON Studio is built and maintained by Suthahar Jegatheesan under the name MSDEVBUILD. It is a free, open-source project rather than a company product. Where data protection law uses the term "data controller", that is the same person — reachable through the MSDEVBUILD contact page.

2. What we do not collect

There is no backend. The entire site is static files — HTML, CSS and JavaScript — so there is no database, no API and no server-side code that could receive your data even if someone wanted it to.

• No user accounts, logins, or profiles.
• No email addresses, names or contact details.
• No analytics or product-usage telemetry of any kind.
• No advertising networks, no third-party trackers, no session recording.
• No cookies are set by this site.
• None of the JSON, YAML, XML, CSV, SQL, tokens or schemas you paste, upload or drag in is transmitted. It is read by JavaScript in your own tab and stays there.

3. What your browser stores locally

To be useful across visits, the site keeps a few things in your browser's localStorage. This is storage on your own device. It is not a cookie, it is not sent with requests, and no one else can read it.

Clearing it: the Recent ▾ → Clear history button on any tool removes that tool's draft and history immediately. Clearing site data in your browser settings removes everything, including the theme and the saved key. Private/incognito windows discard all of it when closed.

The site also uses a service worker cache so it works offline. That cache holds copies of the site's own files — pages, scripts, styles, icons — and nothing you have typed.

4. What leaves your browser, and when

Being honest about this matters more than the marketing line. Five things cause a network request:

1. Loading the site itself. Our hosting provider receives the normal information any web server receives — your IP address, the page requested, your browser's user-agent string and the time — and may keep it in access logs for security and abuse prevention. We do not add anything to those logs and do not use them to profile anyone.
2. Google Fonts. Pages load the Inter and JetBrains Mono typefaces from fonts.googleapis.com and fonts.gstatic.com. That request tells Google your IP address and user-agent. If you would rather it did not, a content blocker or a browser that blocks third-party requests will stop it; the site still works, with your system font instead.
3. Cloudflare's CDN. Two tools load one library each from cdnjs.cloudflare.com: the diagram page loads D3, and the YAML converter loads js-yaml. Same disclosure — Cloudflare receives your IP and user-agent. No other tool loads anything third-party.
4. The AI panel — only if you use it. See the next section.
5. Share buttons — only when you click one. Choosing WhatsApp, Teams, LinkedIn or X opens that service in a new tab and hands it the page address. Nothing is sent until you click, and the page address is all that goes.

Installing the app (PWA) does not change any of this, except that the cached files are served from your own device instead of the network.

5. The optional AI panel

The diagram page has an "explain this JSON with AI" panel. It is off unless you use it, and it works like this: you paste your own OpenAI API key, and when you press the button, your JSON and that key are sent directly from your browser to api.openai.com. They do not pass through any server of ours, because we do not have one.

Two consequences worth stating plainly: your JSON becomes subject to OpenAI's privacy policy rather than this one, and your API key is stored in your browser's local storage so you do not have to retype it. Do not use this panel with confidential payloads, and do not enter your key on a shared computer. Clearing the field removes the stored key.

6. Sharing links that carry data

Tool pages offer "Copy link with my data", which builds a link containing your payload in compressed form. That payload sits in the URL fragment — the part after the # — which browsers never transmit to a server. The link is therefore resolved entirely in the recipient's browser.

That does not make it secret. Anyone who has the link can read the data in it, and it may be recorded wherever the link travels: chat history, mail servers, browser history, screenshots. Do not create such a link for anything confidential.

7. The browser extension

The optional JSON Studio extension asks for two permissions: contextMenus, to add its right-click menu, and storage, for preferences. It requests no host permissions, meaning it cannot read or change the pages you visit. When you choose "Send to JSON Studio", the text you had selected is passed to the tool page through the URL fragment described above — again, not transmitted to a server. The popup may read your clipboard to pre-fill the paste box; deny that prompt and everything else still works.

8. Your rights under GDPR, UK GDPR and India's DPDP Act

These laws give you rights over personal data an organisation holds about you — access, correction, erasure, portability, objection, and the right to complain to a supervisory authority.

We hold none. There is no account, no database and no record of your visit beyond the hosting provider's standard access logs, which we do not query or export. In practice that means most of these rights have nothing to act on. If you believe we hold personal data about you, write to us using the contact link below and we will look and tell you honestly.

Because no personal data is collected for our own purposes, there is no processing to consent to, no legitimate-interest balancing to publish, and no international transfer mechanism to declare. The third parties named in section 4 are a different matter: their handling of your IP address is governed by their own policies — Google, Cloudflare and, if you use it, OpenAI.

9. Children

The site is a developer utility and is not directed at children. It collects nothing from anyone, of any age.

10. How to verify all this yourself

You do not have to take our word for any of it:

• Open your browser's developer tools, go to the Network tab, and use any tool. Beyond the initial page, fonts and the two libraries named above, it stays silent.
• Read the source — the whole site is on GitHub, with no build step, so what you read is exactly what runs.
• Disconnect from the network. Every tool keeps working, which is only possible because none of them needed a server.

11. Changes to this policy

If the site changes in a way that affects any of the above — a new third-party dependency, say — this page changes with it and the date at the top is updated. There is no mailing list to notify, because we do not have your address.

12. Contact

Questions about privacy, or a correction to this page: contact Suthahar via MSDEVBUILD, or open an issue on GitHub.

See also: Terms of use · About this project