Privacy Policy and Data Handling

Last updated 2026.10.03

What you type or paste into the tools is processed only in your browser. It is not sent to a server, logged, or stored.

1. Basic principles

ZEKILO Dev (the “Site”) is operated by HYUNJUNG S&C (the “Operator”), which handles user information according to the following principles.

Every tool runs in the user’s browser. The text you type or paste into a tool, the contents and name of a file you open, and the result (together, “Input”) are not included in the page address (URL) and are not sent to a server or to analytics.
Input is not stored. It is gone when you reload the page or close the tab. The only values kept in the browser are those listed in Section 6.
The Site has no sign-up or login, no sharing links that store Input, and no server database that stores user information.
However, the information in Section 2 may be processed in the course of analytics, advertising, delivery of the Site (hosting), and email inquiries.

The technical details and the steps to verify them yourself are described in How Zero Send Works.

2. Information we process and why

Email inquiries and error reports

Items: email address, name (if shown in the email), the content of the inquiry, and the tool ID, page address, browser and operating system information, and error code that are filled in automatically for an error report
Purpose: replying to inquiries, checking and fixing tool errors
How it is collected: email sent by the user. Input is not attached automatically to an error report email.

Analytics (Google Analytics 4)

Items: identifiers stored in cookies or similar storage, the address and title of the pages visited, usage events (Section 4), device, browser, and operating system information, the referring page, and an approximate location estimated from the IP address
Purpose: statistics on visitors and usage flows, service improvement
How it is collected: the Google Analytics script included in the pages sends it from the user’s browser to Google
The analytics script is loaded only when a page is opened on the production domain (dev.zekilo.com), and only after the Operator has configured a measurement ID.

Items: cookies and advertising identifiers, pages visited, ad impression and click information, IP address, device and browser information
Purpose: serving ads, interest-based personalized ads, measuring ad performance, preventing invalid clicks
How it is collected: the advertising script sends it from the user’s browser to Google and to third-party ad vendors approved by Google (Section 5)
Ads start only after Google AdSense approves the Site. Before that, the advertising script is not loaded.

Site access records

Items: IP address, requested page address, browser information, date and time of access, and similar data
Purpose: delivering web pages, responding to security threats and outages
Processing: handled on the servers of Cloudflare, Inc., which hosts the Site.

3. Cookies and how to refuse them

A cookie is a small text file that a website stores in the user’s browser.
The Site itself sets no cookies. Cookies and similar technologies are used by the Google Analytics 4 and Google AdSense scripts for the purposes in Section 2.
You can refuse cookies or delete stored cookies in your browser settings. See your browser’s help for how to do this. The tools keep working when cookies are refused.
Analytics: installing the Google Analytics Opt-out Browser Add-on stops visit information from being sent to Google Analytics.
Advertising: you can turn off personalized ads in Google Ads Settings. Even if you turn off personalized ads or block cookies, the information needed to load ads (such as the IP address and browser information) is sent to Google on pages that show ads. The Site cannot block that transmission alone.

4. Analytics tool (Google Analytics 4)

The Site uses Google Analytics 4 by Google LLC to understand how it is used and to improve the tools. It applies to every page opened on the production domain (dev.zekilo.com).

The Site itself sends two events: tool use (tool_use) and tool error (tool_error).
The only values sent with tool_use are the tool ID, the kind of action (one of format, encode, decode, copy, download, generate), and the input size range (one of <1K, 1-64K, 64K-1M, >1M).
The only values sent with tool_error are the tool ID and the error code (for example, E_JSON_SYNTAX).
Input and the exact input length are in neither the event values nor the page address (URL), so they are not sent to Google. The code filters event values so that only those on the allowlist above are sent.
In addition, Google Analytics 4 collects some information automatically. This includes automatically collected events such as page views, session starts, and first visits, and, when enhanced measurement is enabled, events such as scrolls and outbound link clicks (the address of the link).
When the root page (/) moves you automatically to the Korean or Japanese pages, the address of the page that referred you before the move is passed to analytics once (Section 6).
Google signals, which associates analytics information with Google accounts, and the use of analytics information for ad personalization are both turned off.
How Google handles this information is described in How Google uses information from sites or apps that use our services and the Google Privacy Policy.

The Site serves ads through Google AdSense by Google LLC. Ads start after Google approves the Site.
Ads may be served by Google and by third-party ad vendors approved by Google.
Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this Site and to other websites.
Google’s use of advertising cookies enables it and its partners to serve ads to users based on their visits to this Site and other sites.
Advertising information is not collected and handed over by the Operator. Google and the third-party ad vendors approved by Google collect it directly from the user’s browser through cookies and similar means for advertising purposes, and handle it under their own privacy policies.
The Site does not pass Input to the advertising script or to ad vendors.
You can turn off personalized ads in Google Ads Settings. Ads are still shown after you turn it off, and they may be based on the content of the page and similar signals.
How Google uses advertising cookies is described in Advertising – Privacy & Terms – Google.

Behavioral information is processed for personalized advertising as follows.

Behavioral information collected: website visit history, ad impression and click history
How it is collected: collected automatically by the advertising script when a user visits a page that shows ads
Purpose: serving ads matched to the user’s interests, measuring ad performance, preventing invalid clicks
Businesses that collect and process it: Google LLC and third-party ad vendors approved by Google
Retention period: Google anonymizes advertising server logs by removing the IP address after 9 months and cookie information after 18 months. Third-party ad vendors follow their own policies.
User controls: turning off personalized ads in Google Ads Settings, blocking or deleting cookies in the browser (Section 3)

The ad placement rules are described in the Advertising Notice.

The Site keeps the following four values in the user’s browser storage (localStorage and sessionStorage). Input is not stored.

Notice banner acknowledgment: the Site shows a cookie notice banner. When you select “OK”, the date of acknowledgment (in UTC, for example, 2026-10-03) and a version number for the storage format are saved in localStorage under the name zd-consent so that the banner is not shown again.
Display language: when you choose a display language (English, Korean, or Japanese) in the language menu, the choice is saved in localStorage under the name zd-lang. The root page (/) follows the saved language if there is one; otherwise it moves you to the Korean (/ko/) or Japanese (/ja/) pages according to your browser’s language settings.
Tool options: when you change a tool option such as indentation, the option values are saved in localStorage under the name zd-opt: followed by the tool ID (for example, zd-opt:json-formatter) so that the same options apply next time.
Referring page: when you arrive at the root page (/) from another site and are moved automatically to the Korean or Japanese pages, the address of the referring page is kept briefly in sessionStorage under the name zd-ref. It is passed once to analytics on the page you are moved to and then deleted. If it is not passed, it is still deleted when you close the tab.

The notice banner is for information only. Whether you select “OK” does not change whether the analytics or advertising scripts are loaded. See Section 3 for how to refuse analytics and personalized ads.

The values of zd-consent, zd-lang, and zd-opt: plus the tool ID are not sent to a server. Clearing the site data in your browser deletes all of the values above.

7. Retention and deletion

Email inquiries: deleted without delay once the reply and any fix are complete. If a law requires them to be kept, they are kept for that period. The details of a confirmed tool error (the tool ID and what was wrong) may be recorded in the change history in a form that does not identify an individual.
Analytics information: user-level and event-level data in Google Analytics 4 is deleted automatically after the retention period of 2 months (the Google Analytics 4 default). Aggregated statistical reports that cannot identify an individual may remain regardless of this period. If the retention setting changes, this policy will be revised as well.
Advertising information: Google anonymizes advertising server logs by removing the IP address after 9 months and cookie information after 18 months (Advertising – Privacy & Terms – Google). Information collected by third-party ad vendors follows each vendor’s policy. You can delete cookies yourself in your browser.
Site access records: governed by the Cloudflare Privacy Policy.
Method of deletion: information in electronic files is deleted in a way that cannot be recovered.

8. Provision to third parties

The Operator does not provide users’ personal information to third parties, except where required by law.

The hosting and analytics in Section 9 are processing entrusted by the Operator for the operation of the Site.
The advertising information in Section 5 is not provided by the Operator. Google and the third-party ad vendors approved by Google collect it directly from the user’s browser.

9. Entrusted processing and overseas transfer

To operate the Site, the following tasks are entrusted to overseas businesses, and information is transferred abroad in the process.

Cloudflare, Inc.

Country: United States and others
Contact: privacyquestions@cloudflare.com
Entrusted task: hosting and delivery of the Site, responding to security threats
Items transferred: access records such as IP address, requested page address, browser information, and date and time of access
When and how: sent over the network each time a user accesses the Site
Retention period: governed by the Cloudflare Privacy Policy
Policy: Cloudflare Privacy Policy

Google LLC

Country: United States and others
Contact: googlekrsupport@google.com
Entrusted task: analytics (Google Analytics 4)
Items transferred: the analytics information in Section 2
When and how: sent over the network from the browser when a user visits a page
Retention period: 2 months (Section 7)
Policy: Google Privacy Policy

Advertising (Google AdSense) information is collected directly by Google and the third-party ad vendors approved by Google, as described in Section 5, and may be processed in the United States and other countries.

How to refuse and what happens

Analytics: installing the opt-out add-on in Section 3 stops information from being sent to Google Analytics. The tools work without restriction when it is installed.
Advertising: you can turn off personalized ads, but the Site cannot block the transmission needed to load ads on pages that show ads (Section 3).
Hosting: delivery through Cloudflare is required to reach the Site, so refusing it means the Site cannot be used.

10. Security measures

Input is not sent to a server and is not stored, and there is no server database, which keeps the personal information we hold to a minimum.
The Site is served over an encrypted connection (HTTPS).
Inquiry emails are managed in an account that only the Operator can access.
Analytics events do not include Input, and automated tests confirm that Input is not carried in requests.

11. Your rights and how to exercise them

You may request access to, correction of, deletion of, or suspension of processing of your personal information held by the Operator (such as the content of an email inquiry).
Send requests to the email address in Section 13. To confirm your identity, please write from the email address you used for the inquiry. The Operator will act within the period set by applicable law.
Requests may also be made through a legal representative or an authorized person.
The Operator cannot identify a specific individual from the analytics and advertising information collected through cookies, so please manage it yourself with the methods in Section 3 (deleting cookies, the opt-out add-on, Ads Settings).

12. Personal information of children under 14

The Site does not knowingly collect personal information from children under 14. If a child under 14 sends an inquiry by email, the Operator may ask for confirmation from a legal representative before replying.

13. Privacy officer

Privacy officer: KIM HYUNMIN (representative)
Contact: manager@zekilo.com

Please send privacy-related inquiries, complaints, and requests for remedy to the contact above.

14. Remedies for infringement of rights

If you need consultation or dispute resolution regarding an infringement of personal information, you can contact the following agencies in the Republic of Korea.

Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
Korea Internet & Security Agency, Privacy Infringement Report Center: 118, privacy.kisa.or.kr
Supreme Prosecutors’ Office: 1301, www.spo.go.kr
Korean National Police Agency: 182, ecrm.police.go.kr

15. Effective date and change history

When this policy changes, the effective date and what changed are shown on this page.

Effective date: October 3, 2026
October 3, 2026: Established