Privacy Policy

The short version

We don't collect your data. Whatever you paste, upload, or type into any tool on this site never leaves your browser. There is no database, no user accounts, and no analytics that track what you process. The one exception is the SSL Certificate Checker: reading a domain's certificate requires a real network connection from a server (browsers intentionally can't do this from JavaScript), so that one tool sends the domain name you type to our server. We don't log or store the domains you check.

How it works

Unformat is a static website. Nearly all processing happens client-side using JavaScript running in your browser. When you use most tools:

1. Your input — text, files, or anything else you paste, upload, or type — is processed by JavaScript in your browser.
2. The result is displayed in the same browser tab.
3. No network requests are made during processing — with one exception: the SSL Certificate Checker (see below).
4. No data is sent to any server, API, or third party — except the domain name you type into the SSL Certificate Checker, which must reach our server to perform the TLS handshake.
5. When you close the tab, your input is gone. Nothing is stored.

This applies to files, not just pasted text — the PDF tools (merge, split, extract, delete, and rotate pages; fill in forms; sign; and add text) read and rebuild your PDF entirely in your browser. Whatever you draw, type, or upload as a signature stays in your browser too — none of it is ever sent anywhere.

The one exception: SSL Certificate Checker

Every tool on this site processes your input entirely in your browser — except one. The SSL Certificate Checker lets you inspect a domain's public TLS/SSL certificate (its expiry date, issuer, and Subject Alternative Names). Browsers intentionally don't expose this information to JavaScript, so reading it requires a real server-side connection to the domain on port 443.

When you use the SSL Certificate Checker:

1. The domain name you type is sent to our server.
2. Our server opens a direct TLS connection to that domain on port 443 and reads its public certificate — the same information any browser sees when it visits that site over HTTPS.
3. The certificate's issuer, expiry date, and Subject Alternative Names are sent back and displayed in your browser.
4. We do not log, store, or share the domain names you check.
5. Requests are rate-limited by IP address purely to prevent abuse of this endpoint; no request content is retained afterward.
6. No other tool, and no other part of this feature, sends any data anywhere.

Share links in the Schema Visualizer

The SQL Schema Visualizer parses and draws your DDL entirely in your browser. It also offers an optional “Share link” feature, which is worth understanding before you use it.

• It is opt-in. No link is created until you open the share dialog, read the warning, and press “Create link”.
• Your DDL is compressed into the URL's fragment — the part after the #. Browsers never transmit a fragment to the server, so your schema does not reach us and does not appear in any server log.
• That is not the same as private. Anyone you send the link to can decode your table and column names, as can anything that reads URLs along the way — chat link previews, browser history, and bookmark sync.
• When you open a shared link, the DDL is loaded and the fragment is immediately removed from your address bar so it is not re-shared by accident.
• Your schema is never written to localStorage.

What we store

The only data stored is your preferences (cleaning mode, indentation size, auto-copy setting) in your browser's localStorage. This data:

• Never leaves your browser
• Contains no personal information
• Contains none of your text
• Can be cleared at any time via your browser settings

SSL Certificate Checker: the domain name you check is used only to perform that live check and is never logged or stored; your IP address is used transiently, in memory, only to rate-limit abuse.

Cookies

We do not use cookies, and we do not display any advertising on this site.

Analytics

We use Vercel Analytics and Vercel Speed Insights, which collect anonymous, aggregated data (page URL, referrer, country, load performance). Neither uses cookies, tracks individual users, nor has access to any content you process with the tools. We also keep a basic, anonymous visit counter for the site. You can read more about Vercel Analytics privacy.

Third-party links

Our site may contain links to external websites (e.g., GitHub). We are not responsible for the privacy practices of these external sites.

Changes to this policy

We may update this privacy policy from time to time. We will notify users of any material changes by updating the “Last updated” date at the top of this page.

Contact

If you have questions about this privacy policy, please visit our contact page.