Data Handling & Privacy

How browser-based conversion tools process your data without ever sending it to a server — the architecture, the verification steps you can run yourself, and the privacy implications compared to server-side alternatives.

How Browser-Based Conversion Works

Every conversion tool on JSON CSV Tools uses a simple but powerful architecture: your browser does all the work. When you paste data into the input box, it stays within the JavaScript runtime on your machine. The conversion logic — parsing, transforming, formatting — runs as client-side JavaScript. No fetch() calls, no XMLHttpRequest POSTs, no WebSocket streams sending your data anywhere.

The core mechanism is direct DOM access for pasted data. No file inputs, no upload dialogs — paste and go. Here's the essential flow:

Input. You paste text into a <textarea>. The data is now in the browser's memory, accessible only to JavaScript running on that page.
Parse. The page's JavaScript reads the input — JSON.parse() for JSON, a CSV parser for CSV, an XML parser for XML. This step happens entirely in the browser's JavaScript engine (V8 in Chrome, SpiderMonkey in Firefox, JavaScriptCore in Safari).
Transform. The parsed data structure is converted to the target format using pure JavaScript logic. No external library calls, no API gateways, no server round-trips.
Output. The result is written back to a <textarea> or triggered as a download via URL.createObjectURL(). Still in the browser.

Client-Side vs. Server-Side: Architecture Comparison

Aspect	Client-Side (Our Approach)	Server-Side (Typical Approach)
Where data lives	Browser memory (RAM) only	Server memory + potentially disk
Who can see your data	Only you, on your device	Server operator, administrators, logging systems
Data in transit	None — data never leaves the browser	Uploaded via HTTPS; exposed to network intermediaries
Latency	Near-instant (no network round-trip)	Variable — upload time + processing + download
File size limit	Bounded by browser memory (typically 50-200 MB)	Can be arbitrarily large with server resources
Offline support	Yes — works without internet after page load	No
GDPR posture	No personal data processing by the service provider	Must justify data collection, provide DPA, handle deletion requests
Persistence	None — data gone when tab closes	May be stored, logged, backed up indefinitely

How to Verify: Step-by-Step

You don't need to trust us. You can verify that no data leaves your browser in under a minute:

Open Developer Tools. Press F12 (or Cmd+Option+I on Mac) and select the Network tab.
Clear the log. Click the 🚫 (clear) button to remove existing entries so you can see exactly what happens next.
Navigate to a tool. Go to any converter, like JSON to CSV. You'll see requests for the HTML page, CSS, and the AdSense script. These are expected.
Paste data and convert. Paste a JSON object or upload a file, then click Convert. Watch the Network tab.
Observe zero new requests. No POST, no PUT, no WebSocket message. The conversion produced no network activity — because it all happened in your browser's JavaScript engine.

This verification works on any browser (Chrome, Firefox, Safari, Edge) and takes about 30 seconds. It's the same thing a security auditor would do.

Privacy Implications

GDPR Perspective

Under the General Data Protection Regulation (GDPR), processing personal data requires a lawful basis — consent, legitimate interest, contract, etc. However, GDPR applies to data controllers and processors — entities that collect or handle personal data. With client-side-only processing, the service provider (us) never receives your data at all. There is no server-side logging of conversion input/output, no database of past conversions, and no analytics that capture the content you convert. From a GDPR standpoint, there is no personal data processing by the service provider — the processing happens entirely on your own device, under your control.

CCPA / CPRA

The California Consumer Privacy Act gives users the right to know what personal information is collected, request deletion, and opt out of sale. Since JSON CSV Tools collects no personal information from conversion use (we don't have accounts, don't log input/output, and don't have a database of user data), there is nothing to request, delete, or opt out of. The only data collection is the standard AdSense advertising cookie — managed through Google's own CCPA compliance framework.

Comparison with Server-Side Tools

Most online converter tools upload your file to a remote server for processing. Even those that claim to "delete your data after processing" require you to trust that they actually do — and that they don't log, mine, or leak it during the window it's on their server. Server-side converters have repeatedly been caught logging or leaking uploaded data, exposing API keys, credentials, and PII when logging infrastructure is misconfigured. Client-side architecture eliminates this risk category entirely: if the server never has your data, it can't misplace it.

Security Model

JSON CSV Tools uses several layers of browser-enforced security:

Security headers. The site serves X-Frame-Options: DENY to prevent clickjacking, X-Content-Type-Options: nosniff to block MIME-sniffing attacks, and Referrer-Policy: strict-origin-when-cross-origin to control referrer leakage. All three are verifiable with a single curl -I https://jsoncsvtools.com/ command. A strict Content Security Policy is planned for a future update.
No third-party scripts (except AdSense). The only external script loaded is Google AdSense. There are no analytics scripts, no CDN-hosted JavaScript libraries, no tracking pixels, no social media embeds. Every conversion library is self-hosted and served from our domain.
No Cloudflare cookieless beacon. Unlike many sites behind Cloudflare, we do not use their analytics beacon, so no request metadata is sent to analytics services.

Limitations

The architecture has intentional trade-offs:

File size bounded by browser memory. Most browsers can handle 50-200 MB conversions comfortably. Beyond that, the JavaScript heap can exhaust and the tab may crash. This is a hard limit of in-browser processing. For files larger than 200 MB, consider command-line tools like jq or csvkit or a native desktop application.
No persistent storage. There is no history of past conversions, no saved configurations, no "recent files" list. Every session starts fresh. This is by design — persistence would require server-side storage or complex client-side data management, both of which introduce privacy surface area.
No collaboration features. You can't share conversion results with a link, invite teammates to a session, or leave comments on a dataset. These features require server infrastructure that would need to hold your data. If you need collaboration, export the result and share it through your own channels.
Single-threaded conversion. JavaScript in the browser runs on a single main thread. Very large conversions can temporarily freeze the UI while processing completes.

Frequently Asked Questions

Can I trust that my data isn't being uploaded?

Yes, and you don't have to take our word for it. Open your browser's Developer Tools (F12), switch to the Network tab, then use any conversion tool on this site. You will see zero network requests for the data you paste or upload — the only requests are for the page itself and the AdSense script. The actual conversion happens entirely in JavaScript running in your browser, not on a server. This is independently verifiable by anyone at any time.

What happens to my data after I close the tab?

Nothing — it's gone. Your data exists only in the browser's memory (RAM) during the session. There is no server-side storage, no database, no log files, no session persistence. When you close the tab or navigate away, the JavaScript runtime that held your data is destroyed, and the memory is reclaimed by the browser. We cannot recover your data after you close the tab because we never had it in the first place.

Does AdSense see my data?

Google AdSense ad units render in cross-origin iframes that cannot read the main page's DOM, JavaScript objects, or variables. The AdSense loader script is the only third-party code we include and is governed by Google's Platform Program Policies. AdSense may set a cookie for ad personalization, but its ad iframes cannot access the text area where you paste data or intercept conversion results. Our own code transmits nothing — verifiable in the Network tab.

Why don't you offer cloud storage?

Cloud storage would require us to receive, store, and manage your data — which directly contradicts the privacy guarantee that makes this tool trustworthy. Once your data reaches a server, you have to trust the operator (us) not to read it, log it, mine it, or lose it in a breach. By keeping all processing in your browser, we eliminate that trust requirement entirely. We don't have your data, we can't lose your data, we can't be compelled to hand over your data. That's the privacy model, and cloud storage would break it.