Privacy Statement

Last updated: May 1, 2026

This Privacy Statement explains what data Prettify collects, where it goes, and how to control it. Prettify ("we", "our", "us") is operated as a solo project. Contact: prettify.tools@gmail.com.

TL;DR

• Your documents stay on your device. Parsing, editing, and queries run locally in your browser.
• We collect a small set of usage events to help us prioritize what to build next. You can toggle them off any time in Settings → Privacy.
• When you click features that need a server (license validation, short share URLs, bug reports, "Load from URL"), we send only what's needed for that feature to work.
• We don't sell your data. We don't share it with advertisers. We don't run ads.

The rest of this page is the precise version.

What stays on your device

Everything you load into the editor — JSON, YAML, CSV, XML, Mermaid — is parsed, edited, queried, and saved locally. We never upload your file contents to a server for processing.

The app stores the following on your device:

• IndexedDB: your current document and your saved history (5 docs free / 30 docs Pro, up to 50 versions per doc, all compressed).
• localStorage: your theme preference, your analytics opt-in/out choice, your Pro license key (if activated), and a couple of one-shot flags.
• sessionStorage: your open editor tabs and active tab. Survives in-app navigation; cleared when the browser session ends.

You can clear all of this any time by clearing your browser's site data for prettify.tools, or by uninstalling the desktop app.

What we send when you use Prettify

Usage events (PostHog)

We use PostHog to collect a small set of usage events that help us decide what to build. PostHog is configured cookieless — no persistent identifier across sessions on your device.

For each event we send:

• The event name and a short list of coarse properties — never your file contents, filenames, search queries, or jq/SQL/XPath expressions.
• Your platform (web or desktop) and the app version.
• Your IP address — received by PostHog at the network layer and used for coarse geolocation (country, city). PostHog stores this on each event.
• Standard browser metadata that PostHog auto-attaches (browser, OS, device type, page path). We strip the share-URL payload from the page path before sending.

The complete list of events we capture:

• app_started — the app booted.
• get_started_clicked — clicks on the "Get Started" CTA on the landing page.
• format_loaded — you successfully loaded a document. Includes the format, a coarse size bucket (<10kb, 10-100kb, 100kb-1mb, 1mb+), and the source (paste, file, url, sample). Never the file or its name.
• share_url_created, short_share_url_created — you created a share link. Includes the format only.
• format_converted — you converted between formats. Includes the from/to format names.
• share_url_viewed — someone opened a share URL. Includes outcome and format only.
• checkout_initiated — you clicked an upgrade CTA. Includes platform.
• paywall_shown — a Pro paywall was rendered. Includes the feature name and mode.
• split_view_triggered, split_session_ended — you opened or closed split view. Direction and duration.
• upgrade_prompt_clicked — you clicked an upgrade CTA. Feature name only.
• license_activated, license_activation_failed, license_activation_limit_hit, license_deactivated — license lifecycle events.

When you activate a Pro license, we send a SHA-256 hash of your license key to PostHog as the distinct identifier so we can count unique purchasers without storing the actual key.

PostHog data is hosted in the United States.

Defaults:

• On the web, you're opted in by default. Toggle off at any time in Settings → Privacy.
• On the desktop app, you're opted out by default. A first-launch modal asks you to opt in if you'd like to share usage data.

License validation

When you activate a Pro license, we send your license key to our Cloudflare Worker, which forwards it to Lemon Squeezy for validation. The Worker re-validates silently in the background once a week to detect refunds. Your license key is never sent to PostHog and is not stored on our server — it lives in your browser's localStorage so the App can re-validate without prompting you.

Bug reports

When you submit a bug report through the in-app dialog, we send:

• The title, description, and severity you wrote.
• An email address, only if you typed one (used to follow up).
• A screenshot, only if you attached one.
• Technical context: app version, current format and view, viewport size, browser, OS, theme, current page URL.

Note: the page URL may contain a ?share=... parameter if you opened the document via a share link. That parameter contains a compressed (but reversible) representation of the document you were viewing. If you'd rather not include that, clear the URL or load the document fresh before opening the bug-report dialog.

Bug reports are sent to a Cloudflare Worker, which creates an issue in our private Linear workspace. Your IP address is read into Worker memory for rate limiting (3 reports per IP per hour) but is not persisted.

Pro share URLs

When you create a short share URL, we send the compressed share payload and your license key to our Cloudflare Worker. The Worker validates your license, then writes the payload to Cloudflare KV with a one-year TTL. Anyone with the resulting /s/:id URL can view it during that year. Revoking your license does not delete share URLs you've already created.

"Load from URL"

When you use the editor's "Load from URL" feature, your browser fetches the URL you typed directly. If the target server blocks cross-origin requests, the App falls back through one of two third-party CORS proxies — api.allorigins.win or corsproxy.io. Those services see the URL you typed, your IP address, and your user agent.

JSON Schema fetch (Pro)

When you load a JSON Schema preset, your browser fetches it from json.schemastore.org. When you load a custom schema URL, your browser fetches it directly from the URL you typed. The hosting server sees your IP and user agent.

Lemon Squeezy checkout

Clicking the upgrade button opens a Lemon Squeezy checkout page in a new tab or window. Lemon Squeezy is the Merchant of Record for all Prettify Pro purchases — they handle payment, tax, and your billing data. Their privacy policy applies to the checkout flow: https://www.lemonsqueezy.com/privacy.

Cloudflare edge logs

Our web app and our Workers run on Cloudflare. Cloudflare logs standard request metadata (method, path, status, IP, user agent, country, response time) at the edge for every request. This is below the application layer and we don't add to it.

What we don't collect

• Your file contents, filenames, document titles, or any text you load into the editor.
• Your search queries, regex patterns, jq expressions, SQL queries, XPath expressions, or schema definitions.
• Your real name, billing address, or payment details (Lemon Squeezy handles all of that).
• Your email address (with two exceptions: if you type one into a bug report, or if you contact us directly).
• Your raw license key in our analytics (we send a SHA-256 hash to PostHog; the raw key is sent to our Worker only for validation against Lemon Squeezy).

Your choices

• Opt out of usage analytics at any time in Settings → Privacy. Opting out resets your PostHog distinct identifier and stops all event capture.
• Deactivate your Pro license at any time in Settings → License. This clears your license key from local storage.
• Clear all local data by clearing your browser's site data for prettify.tools, or by uninstalling the desktop app.
• Request deletion of any data you've sent us — bug reports, identifiable analytics events tied to your hashed license — by emailing prettify.tools@gmail.com from the email address you used.

Children

Prettify is not directed at children under 16, and we don't knowingly collect data from anyone under 16. If you believe a child has submitted data to us, contact prettify.tools@gmail.com and we'll delete it.

International users

Our web app and APIs run on Cloudflare's global edge network. Our analytics data is hosted by PostHog in the United States. Lemon Squeezy is based in the United Kingdom and processes payments globally. By using Prettify you understand that data we collect may be processed in or transferred to the United States, the United Kingdom, or wherever Cloudflare's edge handles your request.

Changes to this statement

If we change what we collect or where it goes, we'll update this page and the "Last updated" date above. Material changes will also be flagged in the app.

Contact

Questions, requests, or anything else: prettify.tools@gmail.com.