Privacy
Short version: the converter, validator and CSS generator run in your browser and send us nothing. The URL checker fetches the address you give it and keeps only the verdict.
Last updated: · What changed: Added an accuracy table, coverage statement and Chrome 158 sourcing, and a new operator section on the About page.
What stays in your browser
XML, XSL and CSS you paste, upload or generate are processed on your device and are not sent to us.
What the URL checker does
When you press Check, our server fetches the public address you entered (and, if you ask, its stylesheet and the sitemaps in its robots.txt), reads the start of the file and sends the result back. We do not store the address or the file. The only record is an event with the verdict, such as “break” or “safe”, with no address in it. Our crawler identifies itself as XSLTCheckerBot; see the about page.
What we collect
- Usage events (our own log): a random visitor id stored in your browser, the page path, the referring site, campaign tags in the link, the country (from the network), a rough device type, and actions such as running a check, converting or downloading. This first-party event log is kept in our own database.
- Anonymous usage statistics (Google Analytics 4): the site uses Google Analytics (GA4) to count visits and actions such as running a check, converting, or opening the pricing page. It sets first-party cookies to tell visits apart. We do not send it your email, name, file names, file contents or anything you type.
- Rate limit counters: a one-way hash of your network address, combined with a secret, used to cap daily use. The address itself is not stored.
- Messages and emails: if you send the contact form or reserve a plan at checkout, we store your email, the plan and your message.
What we do not do
- No advertising code, no ad networks, no selling of data.
- Your email is used only to reply to you or to send the one message about checkout you asked for.
Third parties
- Cloudflare hosts the site and its database, and may measure page views in aggregate.
- Google Analytics (GA4) receives the anonymous usage statistics described above. No third-party spam check or captcha is used.
Spam protection
Our forms contain a hidden field that people never see; automated bots tend to fill it in, and those submissions are discarded. We also ignore forms submitted implausibly fast, and limit how many messages one network can send per hour and per day, using the hashed address described above.
Your choices
To see or delete what we hold about you, email support@xsltchecker.site.