Privacy Policy

Last updated November 5, 2026. This policy describes how the HTML Code Viewer site handles data as it works today, including the editor, the preview, share links, Load source, feedback and analytics.

Short version

• The site sets no cookies of its own.
• HTML you type, paste or open from a file stays in your browser. Files are read on your device and never uploaded. Format and Minify also run in your browser.
• A share link carries your code inside the link itself, after the # sign. It is not sent to my server, but anyone who has the link can read the code.
• Load source is the one feature that sends something to my server: the web address you type. The server fetches that page once, hands the HTML back to your browser and does not keep it.
• I count page views and feature use with my own analytics under a random ID. It never includes your code or the addresses you type. You can turn it off on this page, and browsers that send Global Privacy Control are never counted.
• A feedback message is stored only if you write one and press send.
• I don’t sell or share personal information, and I don’t use it for advertising.

Who runs the site

HTML Code Viewer is run by Jurgen Pine (“I”, “me” in this policy; see About). I decide what the site collects and why, so I am responsible for that data. To contact me about privacy, including any of the requests under “Your rights”, use the Give feedback button on the contact page. There is no public email address.

What is collected at a glance

Code you type, paste or open

The editor, the preview, the console, the Problems list, Page info and the element picker all work inside your browser. The HTML you type or paste is not sent to my server, to my analytics or to anyone else. When you open a file, with the Open file button or by dropping it on the editor, your browser reads it on your device. The file is never uploaded. Format uses Prettier and Minify uses my own code, and both run in your browser too. Copy puts the code on your clipboard and Download saves it as a file on your device; neither sends it anywhere.

So that a reload doesn’t lose your work, the latest editor content is saved in your browser’s local storage under the key hcv:draft. Very large documents, above about 2,000,000 characters, are not saved there. Code opened from a share link is saved only once you edit it, and not at all while you already have a draft of your own. Local storage stays on your device and is never sent over the network, but it does stay after you close the tab. If you use a shared or public computer, press Clear before you leave, or clear this site’s data in the browser settings.

Your viewer settings (whether lines wrap, whether the preview updates as you type, the preview width you chose and the indent size for Format) are saved under hcv:prefs.

Share links

When you press Share link, your code is compressed and written into the link after the # sign. Browsers don’t send that part of an address to a server when someone opens the link, so the code in a share link never reaches my server. It is decoded by the page in the browser of whoever opens it.

Please keep in mind what that means:

• Anyone who has the link can read the code. There is no password and no way for me to revoke a link.
• The link lasts wherever you paste it: chat apps, email, documents and the browser history of everyone who opens it. Deleting your copy doesn’t delete the others.
• Don’t put passwords, API keys, tokens or private customer data in code you share.

When a share link is opened, the viewer loads the code and then removes the # part from the address bar, so the code doesn’t stay in the visible address. The original link may still be in the browser history.

Load source

Browsers don’t let one website read another website’s HTML directly, so Load source goes through my server. When you press Load source, the address you typed is sent to my server as part of the request (/api/source?url=…). The server then:

• refuses addresses that point to private or local networks, such as localhost or a home router;
• fetches the page once, identifying itself as Mozilla/5.0 (compatible; HTMLCodeViewer/1.0; page source viewer), following up to 5 redirects;
• gives up after 12 seconds and stops reading after 5 MB;
• returns the HTML to your browser and does not store it.

The site you asked for sees a request from my server, not from your device, so it doesn’t receive your IP address from this step. My hosting provider’s request logs may record the address you typed along with the request, as they record every request. Don’t use Load source for addresses that contain private tokens or one-time links.

The preview and third-party content

The preview runs your HTML in a sandboxed frame. Scripts are allowed, but the frame has no same-origin access, so code in the preview can’t read this site’s pages, its storage or its cookies. Open in new tab loads a small empty page from this site (/preview-tab, which receives no code) and your browser then hands the code to it directly. That page is served with a sandbox policy, so it also has no access to this site’s storage, and it can’t control the tab it was opened from. The print dialog works there. Alert, confirm and prompt calls never open a dialog: in the preview they are written to the console; in the new tab alert does nothing, confirm answers yes and prompt returns its default.

Your own HTML may load images, scripts, fonts or stylesheets from other servers. Pages brought in with Load source usually do. When the preview loads those files, your browser connects to those servers directly, and they see your IP address and browser details like any web page would. Some may set their own cookies or run their own tracking. I have no control over that. If you don’t want a page’s external files to load, remove those references from the code before you preview it. With Live switched off, newly opened files, examples, fetched pages and share links wait for you to press Run.

The site’s own fonts are bundled into the site when it is built and served from my domain, so visitors’ browsers don’t contact Google Fonts or any other font service.

Feedback you send

The Give feedback button opens a short form. Nothing is sent while you type. Only if you press send, these details go to my feedback service, which runs on Supabase, and are stored so I can read and handle the message:

• the message you wrote, exactly as you wrote it;
• this website’s domain and the path of the page you were on, without any query string or # part (so a share link’s code is never included).

The form doesn’t ask for your name or email. If you want a reply, include a way to reach you in the message; I will use it only to answer you. To limit spam, the feedback service allows up to 10 messages per hour from one network, so it processes your IP address to apply that limit. Please don’t include passwords, keys, payment details or other sensitive information in a message, and don’t paste private code into it.

Analytics

I run my own analytics service, hosted on Supabase, to learn which features people use and where the site fails. It is not Google Analytics and it is not shared with any advertising network. It records:

• page views, with the page path only (nothing after ? or #);
• time on the page and how far you scrolled;
• clicks on labelled buttons and controls;
• whether a feature worked or failed, with the feature’s name and, for some, a number or short code: opening a file (with the file size), pasting from the clipboard (with the length of the pasted text), loading a page’s source (with the HTTP status the site returned), Format, Minify (with the percentage saved), Copy, Download, Share (with the link length), loading an example (with the example’s ID), the element picker, and opening a share link (with the code length, or that the link was damaged);
• a random visitor ID, a random session ID and the time.

It does not record the text you typed or pasted (your code), the contents of a share link, the web addresses you type into Load source, your name, your email or anything else that identifies you, and it doesn’t store your IP address as a way to identify you. The visitor ID is kept in your browser’s local storage and the session ID in session storage, both under keys starting with wa_. They are random, are not linked to any account and are not used on other websites.

The analytics script is loaded from my Supabase project on every page, so Supabase receives your IP address and browser details when your browser fetches the script, as any web server does, even if you have turned analytics off. There is no consent banner: analytics is limited to the items above, is used only to improve this site, and can be switched off here at any time.

Turning analytics off stops all events and deletes the wa_ IDs from this browser. Your choice is saved in local storage under html-code-viewer:analytics-off, so it applies only to this browser on this device. If you clear this site’s data, the choice is cleared too and you would need to turn it off again.

Cookies and browser storage

The site sets no cookies of its own. It uses your browser’s storage as listed below, and you can clear all of it at any time in your browser’s settings for this site. Pages you preview may set their own cookies or storage inside the sandboxed frame, or through third-party files they load, which is outside my control.

Hosting and server logs

The site is hosted on Vercel. The servers that deliver its pages receive technical information with every request, such as your IP address, browser type and version, the address requested and the time. That includes Load source requests, whose address contains the page you asked for. The host may keep this in short-lived logs for security, abuse prevention and troubleshooting. I don’t combine those logs with analytics or feedback.

Service providers and transfers

Two service providers process data on my behalf, only for running this site:

• Vercel: hosting, delivery of the pages and running the Load source server code.
• Supabase: the databases that store analytics events and feedback messages, the feedback rate limit, and the server that delivers the analytics script.

These providers may process data in the United States and in other countries where they or their sub-processors operate. Where the law requires it, such transfers rely on the providers’ standard contractual safeguards.

Why the data may be used

If you are in the European Economic Area or the United Kingdom, the legal bases I rely on are:

• Legitimate interests for analytics, server logs and the feedback limit: understanding how the site is used, fixing faults and keeping it safe from abuse. I keep this light by never recording your code or the addresses you type, by honoring Global Privacy Control and by offering the switch above.
• Providing the feature you asked for (Load source): the address has to reach my server for the server to fetch the page.
• Your choice to contact me for feedback: a message is stored only because you sent it, and it is used to read and answer it.

Code in the editor, in your browser storage and in share links never reaches me, so I don’t process it. You can object to analytics at any time by turning it off above.

Sharing and selling

I don’t sell personal information, rent it or share it for targeted advertising, and I don’t combine it with data from other sources. Apart from the service providers above, I would disclose information only if the law required it, to protect the site or its users from fraud or abuse, or as part of a transfer of the site to a new owner, who would stay bound by this policy for data collected under it.

How long data is kept

• The saved draft, your settings, the analytics visitor ID and your opt-out choice: in your browser until you clear this site’s data.
• The analytics session ID: until you close the tab.
• Share links: as long as the link exists wherever it was pasted; I never receive a copy.
• Pages fetched with Load source: not stored by me at all.
• Analytics events: only as long as they help me improve the site, reviewed for deletion at least once a year. There is no automatic deletion schedule. I may keep totals with no IDs in them, such as page views per day, for longer.
• Feedback messages: until they have been dealt with, and reviewed for deletion at least once a year.
• Hosting and provider logs: according to each provider’s retention period.

Security

The site is served only over HTTPS. The preview is sandboxed so that previewed code can’t reach this site’s pages or storage. Load source refuses private and local network addresses, including after redirects. Analytics events and feedback are written through narrow interfaces that accept new records but don’t let a visitor read anyone else’s data, and access to the stored data is limited to the person who runs the site. No system is perfectly secure, which is one more reason not to put secrets in code you preview or share.

Your rights

Depending on where you live, for example under the GDPR, the UK GDPR or US state privacy laws, you may have the right to ask whether I hold information about you, to get a copy of it, to have it corrected or deleted, to restrict or object to how I use it, and to withdraw a choice you made. You won’t be treated differently for using these rights.

To make a request, use the feedback form and say what you want. Because I don’t collect names or accounts, I can usually only find a feedback message if you tell me roughly what it said and when you sent it, and I can only find analytics events if you give me the visitor ID from your browser’s storage (the wa_ key). Turning analytics off is the quickest way to stop further collection. Anything kept only in your browser, such as the draft, you can delete yourself by clearing this site’s data. I act on requests within one month; because the form has no reply field, include a way to reach you if you want a written answer. If you are in the EEA or the UK, you can also complain to your local data protection authority.

US state privacy laws

In the past 12 months I have collected, as described above, internet activity on this site (analytics events and server logs) and the content of feedback messages people chose to send. I have not sold personal information or shared it for cross-context behavioral advertising, and I don’t use or disclose sensitive personal information. Residents of California and other states with similar laws can make the requests described under “Your rights”.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, the analytics script doesn’t record anything and there is no setting to change. There is no common standard for responding to the older Do Not Track signal. I don’t track you across other sites, so there is nothing for it to switch off, and you can still turn analytics off above.

Children

The site is a general-audience tool for viewing HTML. It is not aimed at children, and I don’t knowingly collect personal information from children under 13 (or under 16 in the EEA and the UK). If you believe a child has sent me personal information in a feedback message, tell me and I will delete it.

Changes to this policy

I will update this page, and the date at the top, whenever the way the site handles data changes. If a change means collecting something new, it will be described here before it starts. Questions about this policy can go through the contact page.