json2toon.co

Privacy Policy & Data Security

Last updated: October 11, 2026

1. Introduction

This policy explains what data json2toon.co (the website, the public API and the MCP server) processes and why.

The data controller is Bartosz Karwacki, Poland. For privacy questions or requests, email privacy@json2toon.co.

In short: the converter runs in your browser, the site sets no cookies, and the only data we receive is cookieless page-view statistics and the request logs every web host keeps.

2. Data Processing

2.1 User Content (Input Data)

We do not collect, store, or transmit your file content.

  • All conversions happen 100% client-side in your web browser.
  • Your input data (JSON, CSV, YAML, etc.) never leaves your device.
  • The web converter never sends your content to a server. The optional public API (/api/v1/toon) and MCP server (/api/mcp) process only the content you explicitly send to them, in memory, and do not store it.

2.2 Infrastructure Data (Hosting)

Our website is hosted on Cloudflare (Workers). While Cloudflare does not access your file content (which stays in your browser), they process standard web traffic data to deliver the website to you securely.

  • Data Processed: IP address, system configuration information, and other traffic data necessary for the operation of the website.
  • Purpose: Security (DDoS protection), reliability (CDN), and performance.
  • Legal basis: our legitimate interest in delivering a secure, working website (GDPR Art. 6(1)(f)).
  • Retention: request logs are kept for the short period set by Cloudflare's log retention, then deleted.
  • Cloudflare acts as our processor under its Data Processing Addendum.

3. Local Storage

We use your browser's Local Storage to save your preferences, such as:

  • Theme preference (light/dark mode).
  • Format settings (indentation, delimiters).
  • Your current document, so it is still there after a reload.
  • Recent conversion history.

Private mode (in the converter's ⋯ menu) turns off the saved document and the history.

This data is stored only on your device and is never sent to us.

4. Analytics

We use two cookieless tools to count visits and measure page speed. None of them sets cookies, builds a profile of you or tracks you across other sites, so no consent banner is needed:

  • Cloudflare Web Analytics: page views, referrer, country, browser and device type, and page load performance (Core Web Vitals). It uses no cookies or local storage and does not fingerprint visitors.
  • Ahrefs Web Analytics: page views, referrer, link clicks, browser language and screen size.

We only see aggregated reports. Legal basis: our legitimate interest in understanding which pages are used and keeping the site fast (GDPR Art. 6(1)(f)).

These tools receive page addresses, never the data you paste. Share links keep your data in the URL fragment (the part after #), which browsers never send to a server, and the site removes that fragment from the address before any analytics script can read it, including when a share link is opened in a tab that is already on the site. The conversion statistics in the converter menu are stored only in your browser.

How to verify that nothing is uploaded

  1. Open the converter and your browser's DevTools (F12, or Cmd+Option+I on a Mac), then the Network tab.
  2. Clear the list, paste some data and convert it, change formats, copy the output.
  3. Inspect every request that appears. You will see editor and tokenizer files loading from json2toon.co and analytics page-view pings, and none of them contain your input or output.

The source code is public on GitHub.

5. International Transfers

Cloudflare and Ahrefs may process data outside the European Economic Area, including in the United States. These transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

6. Your Rights

Under the GDPR you can ask for access to, correction or erasure of your personal data, restrict or object to its processing, and ask for a copy in a portable format. Email privacy@json2toon.co and we will reply within one month. Because we store no accounts and analytics is cookieless, we usually hold nothing that can be linked to you.

Data saved in your browser (section 3) is under your control: clear it in the converter's history panel or in your browser settings.

You can also complain to a data protection authority, for example the Polish President of the Personal Data Protection Office (UODO) or the one where you live.

7. Children and Changes

The site has no accounts and is not directed at children. If this policy changes, the date at the top changes with it.