Privacy

Where your data goes

• Reading, fixing, comparing, searching, converting — this tab. Your text is never sent anywhere, on any page.
• A batch of files — this tab, file by file. The zip is built here. No request is made.
• Your open files and recents — this browser’s storage. Never synced.
• Share links — the URL itself. Browsers never send the part after #.
• Page counts — on these pages only. We count how many people opened a page, pasted into its field, pressed the button into the app, pressed a buy button, and pressed a door to the VS Code extension: five totals per page per day, on our own server, and beside each one a word for where the visit came from — one of a fixed list (google, youtube, a link from another site we know by name, a link from our own pages, no referrer at all, or simply other). The address you came from is turned into that word in your browser and never sent. No cookie, no id, no session, no third-party script, and no page count from /editor or Preferences. Global Privacy Control and Do Not Track are honoured, and the table it is kept in has no column a visitor could go in.
• Visits to the app — one count, and only this one. When you open /editor on a day, a week or a month this browser has not been counted for yet, it sends one small request saying so, with a word for each: how long since its last visit (the day before, within a week, within a month, longer, or first time) and on how many of the last 28 days it came (1, 2–3, 4–9 or 10 and more). Which days those were is kept in this browser’s storage and never sent. No id, no page, nothing about your text, your files or your tabs, and Preferences sends nothing. It counts a browser, not you: we can tell how many browsers came back this week, never which. Global Privacy Control and Do Not Track are honoured — nothing is sent and nothing is written.

What we store

• localStorage: your preferences, your shortcut map, the metadata for your open tabs and recents, and the days you opened the app in the last four weeks (for the visit count above, never sent). A few hundred kilobytes at most.
• IndexedDB: the body of any document over 256 KB, so a large file does not blow the localStorage quota. Stored under this origin only.
• Cookies: none. There is no account to keep you signed in to.

Preferences → Privacy measures all of it and clears it row by row, and “Erase everything” removes the lot.

What we never collect

• Session replay, tracking pixels, fingerprinting, or any analytics that follows a person from one page to the next. The page counts and the app’s visit count above are totals and cannot be taken apart into visitors.
• Third-party scripts of any kind. The code editor (Monaco) is bundled into the build and served from unstringify.com like every other script on the page; it used to come from cdn.jsdelivr.net and no longer does.
• Font requests. next/font downloads JetBrains Mono and Bricolage Grotesque at build time and serves them from unstringify.com, so your browser never asks Google for either.
• Your data. Your JSON, YAML, XML, CSV and logs stay on your device.

Share links

A share link packs the document itself — compressed — into the URL fragment, the part after #. Browsers never send fragments in HTTP requests, so the shared data reaches no server: not ours, not our host’s. It travels only inside the link you choose to send, and is decoded entirely in the recipient’s browser.

Made by

unstringify is made by one person, Tekin Aydogdu, and released as it is built: every change is dated on the changelog, the app and the VS Code extension each carry a version, and nothing on this site is written for a crawler that the page does not say. The code is not open source; what it does is described here, and every claim above is checkable from your own browser.

Contact

Questions, or something on this page you can disprove: hello@unstringify.com. The terms of use are one page and just as short.