Source processing
The current converters parse, inspect, preview, and export source data with code running in your browser. Selected files are read from your device only after you choose or drop them into a converter. The conversion service does not require an account.
Storage
The first release does not send source-file contents to application storage and does not create cloud drafts. Input, previews, and generated output exist in the active browser context until you replace them, clear them, refresh the page, or close the tab.
Network boundary
The website itself must be downloaded from its host. Once the converter interface and code are loaded, conversion work is performed locally. A browser extension, managed device policy, modified browser, or network monitoring product can operate outside this application's control.
Site hosting and security logs
Cloudflare currently delivers and protects the website. Like other web hosts and security providers, it may process standard request information such as an IP address, browser user agent, requested URL, request time, and security events. This operational traffic is separate from the source-file contents handled by the converter in your browser.
Downloads and clipboard
CSV, XLSX, and conversion-report files are generated in the browser and handed to the browser's normal download mechanism. The copy action uses the browser clipboard permission. You decide where those outputs go after creation.
Optional analytics and cookies
When analytics is configured, Google Tag Manager may deliver our Google Analytics 4 configuration to measure traffic sources, page use, and limited product events. Microsoft Clarity may measure clicks, scrolling, and interface usability through aggregate heatmaps and session replay. These providers remain blocked until you choose Accept analytics. If you reject analytics, the site does not load them. Advertising is not currently loaded.
The conversion workbench is explicitly masked from Clarity recordings so source input, file details, previews, issues, and generated table content are not sent as replay content. Our custom analytics events are limited to the selected converter, action name, output format, and whether a preview was ready or blocked. They do not include source data, table values, filenames, clipboard contents, downloaded file contents, or email addresses.
Optional support payments
If you choose to support DataFormatKit, the payment form is provided by Stripe inside the website. Stripe receives the payment and contact details you enter and may process device, network, and fraud-prevention information under Stripe's Privacy Policy. DataFormatKit can see the payment status and transaction records Stripe makes available to the account, but does not receive or store your full card number or security code.
The payment form loads only after you choose Support DataFormatKit. Opening it does not upload converter input, output, filenames, or previews to Stripe.
Your analytics controls
Your analytics choice is stored in localStorage so the site can remember it. You can review or change that choice at any time using Cookie settings in the footer. Revoking a previously granted choice clears known GA4 and Clarity cookies available to this site and reloads the page without either provider.
Contact email
If you contact DataFormatKit, the message body and delivery metadata are processed by the email routing, mailbox, and sending providers needed to receive and answer it. Do not attach sensitive source files or unredacted personal data. A small synthetic example is usually enough to investigate a conversion issue.
You can review the recommended details and email address on the contact page.
Security and scope limits
Browser-local processing reduces exposure; it does not certify source data as safe or correct. Review downloads before opening them in another application. CSV formula protection is enabled by default, XML DTD declarations are rejected, and processing limits reduce accidental browser exhaustion.