Privacy policy

The short version: your files never leave your device, and we collect nothing.

Your files

CSV files you open here are read and parsed by JavaScript running in your own browser. They are never transmitted, never stored on a server, and never seen by anyone but you. There is no upload endpoint in this application — not a private one, not a temporary one, none.

This includes files opened from a URL. In that case your browser fetches the file directly from the address you gave it; the request does not pass through us, and the URL is not recorded.

Personal data

None is collected. There are no accounts, no sign-up, no email address, no contact form and no newsletter. Nothing about you is stored, because nothing about you is asked for.

Cookies and analytics

This site uses Google Analytics 4 to count visits. It sets cookies in your browser and reports to Google the page you are on, a referrer, your approximate location, and general device and browser information — the same aggregate traffic data almost every site collects, and the only way this one can tell whether it is useful to anyone.

What it does not see is your file. Analytics measures page views, not page contents: no filename, no column headers, no cell values, no row counts. Those never leave your device to begin with, so there is nothing for any analytics tool to collect. That separation is enforced by the browser, not just promised here — see below.

If you would rather not be counted, any content blocker, Firefox's tracking protection, or a browser Do Not Track setting stops it, and every part of the viewer keeps working. There is no advertising network and no fingerprinting script.

Local storage

One value is stored in your browser's local storage: your dark or light mode preference. It never leaves your device and is not readable by anyone else. Clearing your site data removes it, and the page falls back to your system setting.

Server logs

The static files are served from a CDN, which — like every web host — records standard request data such as IP address, user agent and requested path for a short period for security and abuse prevention. These logs cover page requests only and can never contain the contents of a CSV file, because the contents are never sent.

Third parties

There are none. The web font used to be served by Google Fonts, which meant Google received a request — and your IP address — on every page view. It is now served from this domain, so no request of any kind leaves this origin unless you ask for one by pasting a link into the URL box, and that request goes straight from your browser to the host you named. A Content Security Policy sent with every page enforces this: the browser itself will refuse to load a script, style, font or image from anywhere else.

Children

The service collects no personal data from anyone, of any age.

Changes

If this policy changes, the updated version will be posted here. The architectural fact behind it — that there is no server able to receive your file — is not something a policy change could quietly reverse.

Verifying any of this

Open your browser's developer tools, switch to the Network panel, and open a CSV. No request carries your data. Or disconnect from the internet after the page loads and open a file anyway — it works, because there is nothing on the other end.

Last updated: August 25, 2026