Privacy Policy

The short version

Your JSON stays on your device unless you click Share. Formatting, minifying, validating, searching, folding, unescaping and downloading all run as JavaScript in your browser. That content is never sent to us.

Two things do reach our servers: a document you explicitly Share, and an account if you choose to create one. Everything on this page is about those two.

We do not sell your data, and we do not use it for advertising.

Shared documents

When you click Share, the contents of the editor are uploaded so the link has something to serve. Alongside the document we store its size, a checksum, a short preview snippet, an auto-generated summary such as JSON object · 3 keys, any name you add, a view count, and a salted hash of your IP address used only for rate limiting.

Share links are public to anyone who has them. They are not password protected; their only protection is a random 10-character id. We never list them in our sitemap, but we do not block search engines either, so a link posted somewhere public can be indexed. Link previews in Slack, X or Discord show the opening of your document. Treat a share link as sensitive, and do not put credentials, access tokens or personal data in one.

Retention: a share is deleted 7 days after upload, along with its generated preview image. The id itself is retired for a year afterwards so it is never handed out to someone else — that record contains no document content.

There is no self-serve delete yet. Email hello@jsonhero.dev to have a share removed sooner.

Accounts

An account is optional. Every editor feature works without one.

If you create one we store your email address, whatever name the sign-in provider gave us or you later enter (first, last, display), an optional company and job title if you fill them in, a profile picture URL if your provider supplied one, your plan, which sign-in methods are linked to the account, and timestamps for creation, update and last sign-in.

Signing in with Google, GitHub or Microsoft

We receive your email address, name and profile picture from that provider. We do not receive your password, and we ask for no other access to your account there. GitHub is asked only for your profile and email addresses.

If the email address matches an account you already have, the sign-in method is added to that account rather than creating a second one.

Signing in with a code

We email a one-time code to the address you enter. The pending challenge is stored for 15 minutes and deleted as soon as the code is used, expires, or too many wrong attempts are made.

Sessions

Signing in sets one cookie. It holds a random value and nothing else — no name, no email, nothing readable. We store only a hash of it, so our records cannot be turned back into a working session. It is HttpOnly, so page scripts cannot read it, and SameSite=Lax, so other sites cannot use it. Alongside it we keep a salted hash of your IP address and a partial hash of your browser's user-agent string, to spot abuse.

A session lasts 30 days, extended as you use it. Signing out deletes the record on our side, so it stops working everywhere, including on your other devices.

We do not use cookies for advertising or cross-site tracking. Some preferences may also be stored in your browser's local storage; that never leaves your device.

Retention: account records are kept until the account is deleted. There is no self-serve deletion yet — email hello@jsonhero.dev and we will remove your account and its data.

Analytics

We use Google Analytics to understand which features get used and where things break. It records the usual page-view information: pages visited, approximate region, device and browser type, and how you arrived. The contents of your editor are never sent to analytics.

Who else sees your data

We do not sell or rent personal data. It reaches other companies only where they operate part of the service:

• Amazon Web Services — hosting, storage, database, identity and email delivery. Data is held in the Asia Pacific (Mumbai) region; our CDN serves cached pages from locations worldwide.
• Google, GitHub, Microsoft — only if you choose to sign in with them, and only to authenticate you.
• Google Analytics — usage statistics, as above.

We may also disclose data where the law requires it, or to investigate abuse of the service.

Your choices

• Don't share it. If you never click Share, your JSON never leaves your device.
• Edit your details any time on your profile page.
• Sign out to end a session immediately, on every device.
• Ask us to delete your account, or a share, by emailing hello@jsonhero.dev. Depending on where you live you may also have rights to access, correct, export or object to our use of your data; the same address reaches us.

Children

JSON Hero is a developer tool and is not directed at children under 13. We do not knowingly collect their data.

Changes

If this policy changes materially we will update the date at the top and, for anyone with an account, say so in the app. Continuing to use JSON Hero after a change means you accept it.

Contact

Questions, deletion requests, or anything else: hello@jsonhero.dev.