Privacy

Your file never leaves your browser. Below is what that means exactly, and how to verify it instead of believing me.

What happens to a file you open

It is read by the page you already downloaded, parsed in a Web Worker inside the same tab, and displayed. There is no backend. There is no API to send it to. When you close the tab it is gone from memory and nothing is left behind.

This is not a policy decision that could quietly change. There is no server component to this site. It is a folder of static files.

What is stored

One entry in localStorage, under the key treeviewer.prefs.v1. It holds your font size, your indent width, your theme, and your search settings. Something like this:

{"font":13,"indent":16,"theme":"dark","sKeys":true,"sValues":true,"sRegex":false,"sCase":false}

No cookies. No identifiers. Nothing about the files you opened. You can clear it from your browser's developer tools and the page will simply go back to its defaults.

How to check

Three ways, in increasing order of effort.

1. Turn off your network. Load the page, disconnect, then open a file. It works exactly the same. Nothing is being sent because there is nothing to send it to.
2. Watch the network tab. Open developer tools, load a file, and look. After the page itself finishes loading, there are no further requests at all.
3. Read the code. The source maps are published with the site, so the debugger shows you the original TypeScript rather than a minified blob. That was a deliberate choice: it makes the two claims above checkable rather than merely stated. The whole thing is also on GitHub.

There is a Content Security Policy on every response that permits scripts and connections from this origin only. Even if some future dependency tried to phone home, the browser would refuse.

Hosting

The site is static files on Cloudflare Pages. Cloudflare terminates TLS and serves the assets, so it sees the same thing any web server sees: that a browser somewhere requested a page. It does not see your file, because your file is never part of a request.

Analytics and advertising

There is no analytics script on this site and no advertising. If either is ever added, it will be something that works without cookies and without profiling, and this page will say so before it happens rather than after.

Contact

Issues and questions: github.com/virtualparadox/jsontree.