Local-first privacy, stated plainly.

Core JSON processing runs in your browser. Network activity is limited to product operation and clear user-facing flows: opening or replaying remote URLs, Iconify icon search text, configured AI, image preview/download workflows, Paddle checkout, support, and Chrome extension install, uninstall, or rating feedback pages.

Extension install, uninstall, and rating feedback

This English notice supplements every localized Privacy Policy page. For eligible Chrome Web Store or Microsoft Edge Add-ons installations, the shared feedback component opens https://json-all-in-one.dev/en/wp/ after install, registers it as the uninstall destination, and opens it when you choose a low rating. These requests contain the action marker (i or u) or selected rating (r), extension version (v), installation-source category (it), detection method (ds), and a random lifecycle ID (e). The ID links install, uninstall, and low-rating requests from the same extension installation. It is generated randomly, stored only in local extension storage, reused across updates, and never synced between devices. These parameters contain no JSON documents, source page URLs, browsing history, or document diagnostics. Normal ratings open the Chrome Web Store or Microsoft Edge Add-ons review page without these lifecycle parameters. Like other website requests, the server receives the IP address and browser user agent; lifecycle logs also record the request time, HTTP status, and approximate country, city, and network derived from the IP address.

Rate Us storage

The extension syncs Rate Us clicked suppression and the declining-frequency use counter so full-page viewer prompts are not repeated after you choose a rating and are shown less often over time. A temporary pending prompt reservation may keep only a bounded random session id, expiry time, and local use count. JSON documents, source URLs, diagnostics, and telemetry are not stored in this feedback record.

Core processing

JSON All-in-One processes JSON/JSONC locally in your browser, along with NDJSON and NDJSONC, for core viewer, editing, JQ, JSONPath, chart, export, schema, codegen, and diff workflows. We do not build JSON All-in-One with advertising SDKs, tracker scripts, or product analytics. We do not receive your JSON content by default.

Remote URLs and replay

When you open a remote JSON-family URL or replay a recorded JSON request, the browser or extension may request that original source URL to load, validate, stream, or replay content. Some replay paths may use the page’s normal browser session for that same source URL so authenticated JSON endpoints can work. JSON All-in-One does not receive those source bytes.

Iconify and configured AI

Iconify icon search can send the icon search text you type, not your JSON document. Optional AI may send prompts and selected snippets to your configured local model, private endpoint, or third-party provider. Provider API keys can be stored in browser or extension storage and are sent only to the provider you configure.

Image URL detection and downloads

The opt-in image URL detection workflow, optional image preview, selected-image download, bulk image download, ZIP creation, and HTML table image embedding can contact image URLs found in your JSON values after you enable or trigger those workflows. Where browser controls allow, these requests avoid credentials and referrer data. Fetched image results may be cached locally in browser storage or OPFS for preview, copy, download, ZIP export, and optional HTML embedding.

Paddle and support

Paddle handles checkout, payment, tax, receipts, and local payment methods when you buy a license. Support email is used for support, privacy, deletion, refund, duplicate-purchase, and license questions.

Human review, legal, and security

Support material you explicitly send may be reviewed by a human to answer your request. Our use of information received from Chrome APIs follows the CWS User Data Policy / Limited Use requirements. We do not sell data, use it for ads, profiling, resale, or unrelated analytics. We do not allow humans to read user data unless you explicitly ask us to review specific material for support, review is necessary for security, or review is required by law.