Effective date: September 26, 2026
This privacy policy explains how FormatterHQ (“we”, “us”, “our”) collects, uses, shares and protects personal data when you use this website and its tools. FormatterHQ is operated by an individual, based in India, who is the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the “controller” under the EU and UK General Data Protection Regulation (“GDPR”). This policy is published in accordance with the Information Technology Act, 2000 and the rules made under it.
In short: most tools run entirely in your browser and never send us what you paste; we collect only what is needed to run optional features, keep the service secure and fund it through advertising; and you can access, correct, export or delete your data at any time.
1. Data you enter into tools
Formatters, validators, converters, encoders, hash generators and most other tools process your input locally in your web browser. That content is not transmitted to or stored on our servers. Only the following features involve our server:
- Save & Share. When you choose to save, the tool’s content and options are stored so the generated link works. Saved content is automatically scanned for malware, phishing and spam to protect other visitors. Links can be public, unlisted or (for signed-in users) private.
- Load URL. Our server downloads the web address you enter and returns it to your browser. We do not keep a copy.
- Network tools (DNS, MX, nameserver and reverse lookups, broken-link checker). The domain, IP address or URL you enter is sent to our server, which queries public DNS resolvers or the website you named.
- URL reputation checks. When enabled, web addresses found in content you save may be checked against Google Safe Browsing or similar malware lists. Only the addresses are sent — never the rest of your content.
Please do not paste passwords, private keys, API tokens or other people’s personal data into content you save and share.
2. Personal data we collect
| Category | What | When |
|---|---|---|
| Account data | Name, email address, password (stored only as a one-way hash), optional profile picture, sign-in provider ID if you use Google or GitHub | When you create an account (optional) |
| Account activity | Saved snippets, favourite tools, tool history, editor preferences, last sign-in time | While you use an account |
| Shared content | Content and options you save, its visibility, the IP address it was saved from, scan results and any abuse reports | When you use Save & Share |
| Contact messages | Name, email address, message, IP address | When you use the contact form or email us |
| Technical data | IP address, browser and device type, pages requested, referring page, date and time | Every visit (server logs) |
| Usage statistics | Aggregated page views per tool, search terms typed into the site search, addresses that return “page not found” | Every visit; not linked to your identity |
| Cookie and device identifiers | Session and security cookies; advertising and analytics identifiers set by partners | See the cookie policy |
We do not intentionally collect sensitive personal data such as financial, health, biometric or government identity information. Your account password is treated as sensitive personal data and is only ever stored as a salted hash.
3. Why we use personal data (purposes and legal grounds)
| Purpose | Legal ground |
|---|---|
| Providing the features you request (accounts, shared links, lookups, replies to messages) | Your consent and your request to use the feature (DPDP Act s.6; GDPR Art. 6(1)(a)/(b)) |
| Security: malware and spam scanning, rate limiting, preventing abuse and fraud, investigating reports | Legitimate uses permitted by law, including compliance with the IT Rules 2021 (DPDP Act s.7; GDPR Art. 6(1)(c)/(f)) |
| Improving the site using aggregated statistics | Legitimate interest in maintaining a useful service (GDPR Art. 6(1)(f)); aggregated data is not personal data under the DPDP Act |
| Advertising that funds the free service, including personalised ads where permitted | Your consent where required (GDPR Art. 6(1)(a) and ePrivacy rules) |
| Meeting legal obligations and responding to lawful requests | Legal obligation (DPDP Act s.7; GDPR Art. 6(1)(c)) |
Where we rely on consent, you can withdraw it at any time — as easily as you gave it — by deleting your account, changing cookie choices or contacting us. Withdrawal does not affect processing that happened before it.
4. Advertising and Google
This site is funded by advertising, including Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info or, in Europe, youronlinechoices.eu. Learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent before personalised advertising cookies are used. Advertising partners never receive the content you paste into tools.
5. How we share personal data
We do not sell personal data. We share it only:
- with service providers (Data Processors) who host the site, deliver email, protect against attacks or provide advertising and analytics, under contracts that limit their use of the data;
- with sign-in providers (Google, GitHub) when you choose to use them — governed by their own privacy policies;
- publicly, when you choose to publish a public snippet or profile;
- with authorities when required by law, including lawful orders under the IT Act 2000 and the IT Rules 2021 (for example, information requested by an authorised government agency within the time the law requires), or to protect the rights, safety or property of our users or others.
6. Transfers outside India
Our hosting and service providers, including Google, may store or process data in countries other than your own, including outside India. Such transfers are made only to countries not restricted by the Government of India under the DPDP Act, and — for data from the EEA or UK — with appropriate safeguards such as Standard Contractual Clauses.
7. How long we keep data
- Account data: until you delete your account. Deletion removes your profile, favourites, history and private snippets.
- Saved snippets: until you or we delete them, or until a configured expiry period ends. Snippets removed for abuse may be retained for up to 180 days as evidence where the law requires.
- Contact messages: as long as needed to handle your request, then deleted periodically.
- Security logs, abuse reports and server logs: generally up to 180 days, as required for security and by the IT Rules 2021, unless a longer period is required for an investigation or by law.
- Aggregated statistics: may be kept indefinitely because they do not identify anyone.
8. Your rights
Under the DPDP Act, you (the “Data Principal”) have the right to obtain a summary of your personal data and how it is processed, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of your death or incapacity. If you are in the EEA or UK you also have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your data-protection authority. California residents have the rights to know, delete, correct and opt out of the “sale” or “sharing” of personal information; we do not sell personal information, and you can opt out of personalised advertising through the links in section 4.
Signed-in users can download their data and delete their account directly from Account → Settings. Anyone can exercise these rights by emailing hello@formatterhq.com. We may need to verify your identity before acting, and we will not discriminate against you for exercising your rights.
9. Security
We follow reasonable security practices appropriate to the data we hold, including encrypted HTTPS connections, hashed passwords, protection against cross-site request forgery and server-side request forgery, rate limiting, automated scanning of shared content, restricted administrative access with two-factor authentication, and regular software updates. No online service can be completely secure; if we become aware of a personal data breach we will notify affected users and the Data Protection Board of India (and other authorities where required) as the law requires.
10. Children
FormatterHQ is intended for adults and is not directed at children. Under the DPDP Act a “child” is anyone under 18. We do not knowingly process children’s personal data, and we do not track or target advertising at children. If you are under 18, please use the site only with the involvement of a parent or legal guardian and do not create an account. If you believe a child has given us personal data, contact us and we will delete it.
11. Grievance Officer
In accordance with the Information Technology Act, 2000, the IT Rules 2021 and the DPDP Act, 2023, the Grievance Officer for FormatterHQ is:
The operator of FormatterHQ
Email: hello@formatterhq.com
We acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt. See the grievance redressal page for details. If you are not satisfied with our response, you may approach the Data Protection Board of India.
12. Changes to this policy
We may update this policy as the site or the law changes. The effective date at the top shows the current version. Material changes will be announced on the site before they take effect.
13. Contact
Questions about this policy or your personal data: hello@formatterhq.com, or use the contact page.