Privacy Policy

Last updated: [DATE]

This is a template, not legal advice. It was written to describe how the DevConvert software actually behaves, but it has not been reviewed by a lawyer and it does not account for the jurisdictions you operate in, the obligations that apply to you, or any changes you make to the site. Have a qualified lawyer review and adapt this document before you publish it.

1. The short version

DevConvert is a static website. Every converter runs as JavaScript inside your own browser tab. The text you paste, the files you open, and the output that is generated are handled on your device and are not transmitted to us or to anyone else. There is no account, no database and no server-side processing of your content.

The one thing that is not local is loading the page itself. That is an ordinary web request, and section 4 explains exactly what it involves.

2. What happens to the content you convert

Converter input, files you open or drag onto the page, and the output that is produced are processed locally in your browser. The application code contains no network-sending mechanism at all: no fetch, no XMLHttpRequest, no navigator.sendBeacon, no form submission and no third-party API call. Files are read with the browser's File API and never uploaded; downloads are generated from an in-memory blob on your own machine.

The content you convert is also never placed in the address bar. Each tool has its own URL, such as /json-to-yaml/, but that URL only ever identifies the tool. This is deliberate: content in a query string would end up in your browser history, in Referer headers sent to other sites, and in server access logs.

Third-party libraries used for parsing (YAML, TOML, CSV, diffing and identifier generation) are bundled with the site and served from the same origin. No request is made to a content delivery network while you use the tools, and no library provider receives your input.

3. Local storage on your device

The site uses your browser's localStorage to remember things between visits. This data stays in your browser. It is not synchronised, not backed up by us, and not readable by us.

What is stored:

• History. Each conversion may be recorded as an entry containing the tool identifier and label, a timestamp, the options you selected, and a truncated copy of your input and output. Input and output are cut off at 4,000 characters each. By default the most recent 20 entries are kept and older ones are discarded.
• Presets. A named tool-and-options combination that you chose to save. A preset stores option values, not the content you converted. Note that some options are themselves text you typed — a regular expression and its replacement, a root type or element name — and those are saved as part of the preset.
• Settings. Your preferences, such as whether history is recorded, whether conversions run automatically as you type, output line wrapping, and the theme.

You are in control of all of it. History recording can be switched off in Settings, in which case no new entries are written. The History panel has a Clear history button, individual entries can be deleted, and presets can be removed one by one. The Delete all local data button in Settings removes everything the site has stored — history, presets and settings — in one action. Clearing site data through your browser's own privacy controls has the same effect.

If your browser blocks storage — for example in a private window, or when the storage quota is exhausted — the site falls back to keeping this data in memory for the current tab only, and it disappears when you close the tab.

4. Server logs and network metadata

We want to be precise here rather than overstate the case. Saying that conversions are local is a statement about your content. It is not a claim that visiting the site is invisible.

Loading this website involves ordinary web requests for its HTML, CSS and JavaScript files. Our hosting provider, and any content delivery network or reverse proxy sitting in front of it, may record standard server log data about those requests, including your IP address, your browser's user agent string, the date and time, and which URL you requested. This happens with every website you visit and is a property of how the web works, not something the application chooses to do.

That log data is generated and retained by the hosting infrastructure and is outside the application's control. It is typically used for operational purposes such as serving traffic, diagnosing outages and mitigating abuse. It does not contain the content you paste into a converter, because that content is never sent.

[Operator: name your hosting provider and CDN here, link to their privacy documentation, and state their log retention period if you know it.]

5. What the application does not do

• No analytics or usage measurement of any kind is loaded.
• No advertising, no ad networks and no ad personalisation.
• No third-party trackers, tracking pixels, social widgets or embedded content.
• No cookies are set by the application.
• No accounts, no sign-up, no email address or other personal data collected.
• No profiling and no automated decision-making.
• Your content is never sold, shared or disclosed, because it is never received.

6. A note about the JWT Decoder

The JWT Decoder deliberately does not verify token signatures. Verification requires the signing key, and fetching a key set would mean transmitting your token off your device. The tool decodes locally and tells you it has not verified anything. See the Terms of Use for what that means for how much you can trust a decoded token.

One consequence worth stating plainly: history recording is on by default, so a token you decode is written to this browser's local storage along with its decoded claims, up to the 4,000-character limit described above. The same applies to any other secret you paste — an API key inside a cURL command, for instance. Nothing leaves the device, but it does persist on it. Turn history off in Settings, or use Delete all local data, if that matters for what you are working with.

7. Children

This is a developer utility and is not directed at children. Because the site collects no personal data and requires no account, it does not knowingly process children's data.

8. Your rights

Data protection law gives people rights over their personal data, such as access, correction and erasure. In practice, the application holds none of your personal data to act on: the only data associated with you lives in your own browser, where you can inspect and delete it yourself at any time using the controls described in section 3. For server log data, contact the operator at the address below.

[Operator: if you are subject to the GDPR, the UK GDPR, the CCPA or a similar regime, have a lawyer set out the applicable legal bases, the data controller's identity, retention periods and the relevant supervisory authority here.]

9. Changes to this policy

If this site later adds analytics, advertising, payments, error reporting, an account system, or any other feature that transmits data off your device, this document must be updated before that feature goes live, and the "Last updated" date must change. A privacy policy that no longer matches the software is worse than none at all.

Material changes will be reflected on this page. Continuing to use the site after a change means the updated policy applies.

10. Contact

Questions about this policy can be sent to [email protected].

[Operator: replace this with a monitored address, and add a postal address and the legal entity name if your jurisdiction requires one.]

11. Verify it yourself

You do not have to take any of this on trust. Open your browser's developer tools, switch to the Network tab, filter to XHR and Fetch requests, and run as many conversions as you like. The list stays empty. The site is also served with a Content Security Policy containing connect-src 'none', which instructs your browser to refuse every outbound connection the page might attempt — so the guarantee is enforced by the browser, not only by our word.