Local Avro tools with optional assistance.

Last updated: 28 October 2026

This policy covers Avro File Viewer, operated by Ship It! Software Limited. It also covers the separately installed desktop editor and optional browser extension usage statistics, described below. Website, desktop and extension practices are separate.

Local file handling

Selected file bytes, embedded schemas, decoded values, and generated downloads are processed locally in your browser. Local editing does not intentionally transmit file names, schemas, values or contents to our servers. Optional assistance uses schema context in a separate explicit action described below.

Optional schema and synthetic-record assistance

When configured, Assistance sends your goal and the AVSC schema context you explicitly include through this product's server to OpenRouter and the configured model provider. Synthetic-record generation also sends the requested count. The interface shows the included text and configured model ID. OCF record values are not included automatically; anything you manually paste into an included draft is part of that transfer. Checking service availability sends no document contents. Do not include sensitive information you do not want those providers to process. Providers receive ordinary network information and apply their own processing and retention terms; no fixed provider retention period is promised here. The server requests restricted collection and zero data retention, and unavailable provider admission fails closed.

In a desktop build with local assistance enabled, Provider settings also lets you explicitly connect a model already downloaded in your local Ollama service. Local mode sends the same checked schema, goal and requested count to that service through native commands; it does not use OpenRouter or send source-file permissions. The app does not install Ollama or download models. Refreshing the model list requires an explicit action and sends no document contents. Changing providers or losing readiness revokes included context; reconnect and include the schema again before generating. Kept drafts remain available locally. Local model retention and service configuration are controlled by you.

Generated schemas and synthetic records remain untrusted drafts. Local validation checks schema/default semantics and synthetic records through the existing Avro codec, with actual encoded values shown before acceptance. Keeping a reviewed draft is separate from changing an OCF writer schema, appending records or migrating original records. Synthetic downloads are new files and do not acknowledge saving the original. Compatibility requires its own review. Source/revision changes invalidate review authority; Undo is available for the separate draft. Cancelling prevents a later local acceptance but cannot retract information already sent. Provider keys remain on the server. Local validation and file editing continue without assistance. Schema and synthetic-record drafts are not automatic browser recovery; download important work before closing.

Browser-local batch conversion may write temporary results to this site’s private storage on your device. Removing a result clears its temporary copy. Interrupted conversions or downloads can leave temporary files until later cleanup; unused copies older than 24 hours are eligible for cleanup during subsequent conversions. Clear this site’s browser data to remove these local copies. Downloaded files remain until you remove them.

Browser input recovery

Input handoffs up to 64 MiB in total may be stored in this browser’s IndexedDB for 30 minute original-input recovery. Larger handoffs stay in the current tab without copying the whole source into browser storage; reopen the original after refreshing. This recovery-storage threshold is separate from each tool’s file-size limits. Download changes before closing the tab. Expired recovery entries are ignored and cleaned up on subsequent use; clear this site’s browser data to remove stored copies.

Ordinary web request data

Loading pages, policies, scripts, styles, and the favicon sends normal technical request data to Cloudflare, such as IP address, browser details, requested path, time, and security signals.

Purposes, cookies, and analytics

Request data is used to deliver and secure the site and diagnose availability. This website does not set analytics cookies or create advertising profiles. Bounded converter reliability reports are described below.

Service providers and retention

Cloudflare hosts and protects the website and may process and retain request logs under its own operational policies. We retain only technical information available through that service for as long as reasonably needed for security and reliability.

Security and choices

Browser-local processing limits exposure, but no browser or network service is risk-free. You can avoid processing sensitive files here, clear page data, close the tab, or use an offline tool.

Converter reliability reports

To measure converter reliability, the browser sends bounded conversion-start and outcome events to this site for forwarding to PostHog in the United States. Reports include a random identifier for each conversion attempt, fixed source and output format codes, whether processing runs in the browser or on the server, the deployed website release identifier, coarse file-size and duration buckets, and fixed success, failure, cancellation, rejection or interruption categories. An interruption means observation stopped, for example when leaving the converter; a remote conversion job may still continue. Bounded companion events record requests to download results and failures preparing a download, plus successful or failed preview and copy actions. A download request does not confirm that your browser finished saving the file. The attempt identifier is not stored in a cookie or browser storage and does not identify an account or create a person profile. Unexpected converter failures also send fixed failure-category reports to Sentry in the United States. These reports exclude file names, paths, file contents, schemas, rows, cell values, credentials and free-form error messages. The collector does not forward your IP address and disables IP-based enrichment for PostHog events; hosting and receiving services still process ordinary network information. Converter reports are suppressed when your browser sends Do Not Track or Global Privacy Control. Reports are retained as reasonably needed for reliability, subject to service-provider retention controls. Report delivery is best-effort and does not prevent conversion. Browser-local converters continue to process file contents on your device.

Avro Viewer desktop app

The separately installed desktop editor processes selected files and edits on your device and writes outputs to the destinations you choose. This desktop measurement is separate from the website and browser extension.

Desktop releases incorporating the 25 October 2026 reliability update send bounded usage events to PostHog for app starts, successful document opens, the first successful edit of a document, and successful saves. Earlier installed releases retain their previous measurement until updated. Sentry receives application lifecycle and unexpected error diagnostics. Reports include fixed app, installed-version, platform, build-provenance, action, source and outcome categories, with sanitized technical diagnostics. They exclude file names and paths, document contents, schemas, field or column names, cell values, SQL, credentials and arbitrary error text. Debug builds suppress routine remote telemetry; locally built release packages can report development-tagged activity. A failure to deliver a report does not prevent local editing.

Desktop usage measurement uses a random app-scoped installation identifier kept in local app storage and a fresh session identifier per launch. Unavailable identifier storage uses a session identifier instead. Identifiers are not derived from an account, hardware, operating-system identity or documents, and PostHog person-profile creation is disabled. Sentry and PostHog receive ordinary network information, including IP addresses, when reports are sent; their configured desktop collection endpoints are in the United States. PostHog can retain IP addresses and derive approximate location without requesting precise device location. Random identifiers do not make reports anonymous.

Updated desktop apps also keep bounded local lifecycle and panic-category logs for troubleshooting, without document contents, paths or arbitrary error text. Clearing local app data can remove local diagnostic logs and the routine installation identifier; it does not erase reports already received.

Operational analytics and diagnostics are retained as reasonably needed for reliability, security and legal obligations, subject to provider retention controls; no fixed remote retention period is promised here. There is no in-app routine-analytics switch. You can clear local app data or restrict telemetry connections using your device controls while local editing remains available. The website and extension keep their separate measurement practices described elsewhere in this policy.

Optional browser extension usage statistics

If you enable optional usage statistics in an extension version that offers this setting, the extension sends limited usage events to PostHog in the United States to help us understand use and reliability. Share usage statistics is off by default in extension Options. Local file tools work when it is off. Firefox versions also require the browser’s optional technical and interaction data permission before sending events.

Events count workspace opens, successful file opens, exports and failed file opens. They include fixed product, browser and extension version fields and a random installation identifier created and stored on your device only after you opt in. They exclude file contents, file names, URLs, searches, edits and raw error messages. We do not use session replay, automatic interaction capture, analytics cookies or referrer collection.

PostHog receives ordinary network information, including your IP address, when an event is sent. IP-based location enrichment is disabled for these extension events. A random installation identifier does not make the reports anonymous. Events are retained according to our PostHog project retention settings, subject to earlier deletion under provider controls or an applicable request.

Turning Share usage statistics off stops future events and deletes the local installation identifier. It does not delete events already received. Enabling it again creates a new identifier. This setting applies only to the separately installed extension and does not change website or desktop settings.

Changes

We may revise this policy as the utility changes. The date above identifies the current version. Material behavior changes will be reflected here.

Use of the utility is also subject to the Terms.