json:yaml

Privacy policy

The short version of our privacy policy: your documents are processed in your browser and never transmitted. This page sets out what is and is not collected.

Effective 1 August 2026. Last updated .

The short version

Documents you paste, type, or drop onto this site are converted by JavaScript running inside your browser tab. They are never transmitted to us or to anyone else. We set no cookies, run no analytics, embed no third-party scripts, and have no accounts to sign up for.

The only personal data that reaches us is what any web server unavoidably receives when you request a page, plus anything you choose to put in an email. The rest of this page explains that in detail.

Who is responsible

This site is operated by one person as an independent project, published under the name json-yaml.com. For data protection purposes that operator is the controller of the limited personal data described below.

We do not publish a postal address. This is an independent project run by one person rather than a company, and correspondence is handled by email. Full operator details are on the imprint.

Email: contact@json-yaml.com. We aim to reply to privacy requests within a few working days and in any case within the one month required by the UK and EU GDPR.

The documents you convert

What happens to the documents you paste in is the part most people care about, so it is worth being precise.

When you use any converter, validator, or formatter on this site, your document is held in the memory of your browser tab and processed by JavaScript that was downloaded to your device when the page loaded. No network request carries your content. We do not receive it, cannot read it, do not log it, and could not produce it if asked.

You do not have to take our word for this. Two ways to check:

  • Open your browser's developer tools, switch to the Network panel, and paste a document. No request appears.
  • Load the page, disconnect from the internet, and keep converting. It continues to work.

Nothing persists between visits. We do not write your documents to localStorage, sessionStorage, IndexedDB, or any other browser storage. Reloading or closing the tab discards everything.

Files you open with the file picker or drag onto an editor are read with the browser's FileReader API, which loads them into the page. They are not uploaded. The Download button likewise builds the file locally.

Server logs

Requests for pages, stylesheets, scripts, and images are logged by our hosting provider, our hosting provider, in the way every web server does. A log entry contains:

  • the IP address the request came from;
  • the date and time;
  • the URL requested and the HTTP status returned;
  • the referring page, when your browser sends one;
  • the user agent string, which identifies your browser and operating system.

An IP address can be personal data, so we treat these logs accordingly. We use them only to keep the site available, to diagnose faults, and to detect and block abuse such as denial-of-service traffic. We do not use them to build profiles, we do not attempt to identify individuals from them, and we do not combine them with any other source.

Retention: logs are kept for 30 days and then deleted.

Legal basis (UK and EU GDPR): legitimate interests under Article 6(1)(f) — specifically, our interest in operating a secure and reliable service. We have considered your interests and rights and concluded that short-lived operational logging, with no profiling and no sharing, does not override them.

Critically, these logs never contain the contents of your documents, because your documents are never sent to the server.

Cookies and browser storage

This site sets no cookies of any kind. There are no analytics cookies, no advertising identifiers, no consent-management platform, and no participation in any cross-site tracking network. That is why you have not been shown a cookie banner: there is nothing to consent to.

We also do not use browser storage to remember you. The converters keep your input only in page memory for the lifetime of the tab.

Your browser may cache our pages and assets, which is ordinary browser behaviour and entirely under your control through your browser settings. The cookie policy covers this in more detail, including how to verify the absence of cookies yourself.

Third parties

Every asset on this site is served from this domain. There are no content delivery network requests, no web fonts loaded from another origin, no embedded videos, no social widgets, and no tag managers. The YAML parser (js-yaml) is open-source software we host ourselves rather than pull from a CDN, precisely so that loading a page contacts no server other than ours.

We do not sell, rent, or share personal data with anyone. We use no processors other than our hosting provider, who processes server logs on our behalf under their data processing terms.

We may disclose information if legally compelled to do so by a valid order from a competent authority. In practice there is very little to disclose: we hold no account data, no document content, and no logs older than 30 days.

If you email us

If you write to contact@json-yaml.com we receive your email address, your message, and anything you attach. We keep correspondence for as long as needed to deal with your enquiry and for a reasonable period afterwards in case you follow up, then delete it.

We use your address to reply to you and for nothing else. There is no newsletter and no marketing list. If you send us a bug report, please replace any sensitive values in the sample first — the structure of a document is what we need, not its contents.

Your rights

If you are in the UK, the EU, or another region with comparable law, you have the right to request access to your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office.

In practice there is very little to exercise these rights over. We hold no accounts and no document content. The only records that could relate to you are server logs identified solely by IP address, and any email you have sent us. To make a request about either, write to contact@json-yaml.com. For a log request, include the approximate date and the IP address concerned, since that is the only way we can locate an entry. We may ask for enough information to confirm the request is genuine.

We do not charge for responding to requests unless they are manifestly unfounded or excessive.

California residents

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act as amended by the CPRA. We collect no categories of personal information beyond the server log data described above, and we do not use sensitive personal information for any purpose requiring notice. We will not discriminate against you for exercising any right under that Act.

International transfers

Our hosting is delivered from a global content delivery network, so the server that answers your request is normally the one nearest you, and log data may be processed in the country where that server sits. Where a transfer leaves the UK or EEA, it is covered by our provider's standard contractual clauses or an equivalent safeguard.

Children

This site is a developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. Since there are no accounts and no data collection beyond server logs, there is no mechanism by which a child could provide us with personal data other than by emailing us. If you believe a child has done so, write to contact@json-yaml.com and we will delete it.

Security

The site is served over HTTPS. It is a static site with no database, no user accounts, and no server-side processing of your content, which removes most of the categories of breach that affect web applications. We keep our one third-party dependency up to date.

No system is perfectly secure, and you remain responsible for the security of your own device and browser. If you find a security issue with this site, please report it to contact@json-yaml.com.

Changes to this policy

If this policy changes in a way that affects how your data is handled, we will update the date at the top of this page and describe the change. Material changes will be noted on the home page for a reasonable period.

The commitment that conversion happens in your browser is fundamental to what this site is. If that ever changed, it would be announced prominently rather than buried in a policy update.