Skip to main content
${format:vault}

Privacy Policy

Last updated: 2026-03-23

the short version
  • We never see your data. Every format, conversion, and decode operation runs entirely inside your browser using JavaScript. Nothing is uploaded anywhere.
  • We collect no personal data. We use Plausible Analytics — a privacy-respecting, cookieless counter that records only aggregate page view counts. No fingerprinting, no cross-site tracking.
  • localStorage stores only UI preferences — theme and indent size. Your input content is never written to disk.
  • GDPR and CCPA rights are trivial here — there is no personal data to delete, export, or correct.

What we collect

We collect nothing from your input or output. The text you paste into the editor, the files you open, and the results you copy out never leave your device.

The only data we receive is aggregate, anonymous traffic information via Plausible Analytics. Specifically, Plausible records:

  • Page URL (e.g. /json-formatter) and referrer source
  • Browser name, OS, and approximate country (derived from IP, then discarded — the IP itself is never stored)
  • Whether the visit came from a mobile device

Plausible does not use cookies, does not fingerprint your browser, does not track you across sites, and is fully GDPR compliant. Data is hosted in the EU. You can read their full data policy at plausible.io/data-policy.

How processing works

formatvault is a static web application. When you visit a tool page, your browser downloads the JavaScript bundle from our CDN and executes it locally. From that point on, all processing is self-contained:

  • JSON is parsed and formatted using native JSON.parse / JSON.stringify (or json5 for relaxed syntax)
  • CSV is processed by papaparse running in a Web Worker — large files never block the main thread and never touch a server
  • JWT tokens are decoded with jose entirely in-memory — the signature is not verified, and the token payload is not transmitted
  • Base64 strings are encoded/decoded with js-base64; URL strings use native encodeURIComponent / decodeURIComponent
  • Markdown is rendered by marked then sanitised through DOMPurify before display — no raw HTML is ever injected

Files larger than 1 MB are processed in a dedicated Web Worker using a streaming parser so that your data is handled efficiently without any network round-trips. Sensitive payloads — API responses, authentication tokens, configuration files, financial CSVs — can be pasted with confidence.

localStorage

We write two preference keys to localStorage:

  • fv-theme — your colour scheme preference ("dark" or "light")
  • fv-settings — editor preferences such as indent size and tab style

Input content — the text you type or paste into any editor — is never written to localStorage or any other browser storage API. It exists only in JavaScript memory for the duration of your session and is discarded when you navigate away or close the tab.

You can clear all formatvault preferences at any time from your browser's developer tools (Application → Local Storage) or by clearing site data in your browser settings.

Third-party services

Plausible Analytics

Page view analytics via plausible.io. Cookieless, no personal data stored, GDPR/CCPA compliant, EU-hosted. The script is loaded from plausible.io/js/ and sends a single event per page navigation containing only the page path and the data listed under "What we collect" above.

Google Fonts

Fonts (DM Sans, JetBrains Mono, Geist) are loaded from fonts.googleapis.com. This means your browser makes a request to Google's CDN when you first visit the site. Google may log the request IP address and user-agent as part of standard CDN operation. We have no control over that data. If you prefer not to contact Google's servers, you can block the domain in your browser — the site will fall back to system fonts.

Cloudflare Pages

The site is hosted on Cloudflare Pages and served through Cloudflare's CDN. Cloudflare processes HTTP requests in order to serve assets and provides DDoS protection and edge caching. Cloudflare may log request metadata (IP, headers) for security and operational purposes in accordance with their own privacy policy. No application-level user data is accessible to or stored by Cloudflare.

Your rights

Under GDPR, CCPA, and similar regulations you have rights to access, correct, delete, and export personal data held about you. Because formatvault does not collect or store any personal data about individual users, these rights are trivially satisfied — there is nothing for us to provide, correct, or delete.

The only aggregate analytics data we hold (via Plausible) is not linked to any individual and cannot identify you. If you have questions about what Plausible holds, refer to their privacy policy.

Contact

Questions about this policy? Email [email protected]. We'll respond within a reasonable time.