CsvFlex
Privacy & cookies
Last updated 19 October 2026
The short version
- Your files never leave your browser. They are read and queried by a database (DuckDB) running inside this tab, on your own device. Nothing you open, query, clean or export is sent to us or to anyone else.
- Your files are not kept. Close or reload the tab and they are gone from CsvFlex. Only your SQL and settings are remembered, in your browser's local storage.
- There are no accounts and no cookies. No sign-up, no login, and CsvFlex sets no cookies at all.
- Visits are counted, people are not. We use self-hosted, cookieless analytics that collects no personal data and does not follow you between sites or between visits.
What happens to the files you open
CsvFlex runs in your browser. When you open the site your browser downloads the program itself - the same fixed set of HTML, CSS, JavaScript and WebAssembly files everyone gets, including DuckDB, the database that does the work, and three of its extensions (for Parquet, JSON and Excel files). All of them are served from this site; none comes from a content delivery network or anyone else's server. DuckDB is a download of about 6 MB, so the first visit takes a moment, and your browser keeps a copy for the next one.
When you open or drop a file, your browser hands it to DuckDB inside this tab, which reads it from your disk a piece at a time. The file is never uploaded: we do not receive it, and we could not, because nothing in the app sends it anywhere. The same is true of everything that comes from it - the tables, your queries and their results, profiles, charts and clean-ups. Cleaning a table changes the copy inside this tab only; the file on your disk is never written to.
Exports are made in the tab too: DuckDB writes the file into memory, and your browser saves it to your device as a download. It does not travel through us on the way. The same goes for Sample data, which is made up by the app on the spot.
Queries are yours to write, but they cannot reach outside the tab: CsvFlex turns off DuckDB's ability to read web addresses and to fetch extensions from the internet, and locks those settings once it has started, so a query that names a URL fails rather than fetching it.
In practice this means you can disconnect from the network once the app has loaded and carry on working, and it means that opening confidential or personal data in the app does not disclose it to us. What you do with that data remains yours to govern; if it is personal data, you stay its controller.
How to check this yourself
You do not have to take our word for any of the above. Open your browser's developer tools, switch to the Network tab, and use CsvFlex normally: open a file, run some queries, export the result. After the initial load of the application files the only request you will see is the analytics beacon described below, which carries the page's address and nothing from your files. Or go offline after the app has loaded and watch it keep working.
What is stored on your device
CsvFlex remembers what you were doing - not your data - so that closing the tab does not throw your work away. It does this with your browser's local storage, which is a store on your own computer. Nothing written there is transmitted to us or to anyone else, and nothing in it is readable by another website. Your files and their contents are never stored: after a reload you open them again.
| Name | What it holds | Why |
|---|---|---|
cv-session |
The SQL in the editor (left out if it is very long), the builder, clean-up and chart settings, the import options, and which tabs were open. Column and table names you picked are part of those settings; no values from your files are. | So a reload or an accidentally closed tab does not lose your queries and settings. |
cv-theme |
Light or dark, if you have chosen one. | So the app opens in the theme you picked. |
cv-panes |
The sizes you have dragged the tables, query and results panes to. | So your layout survives a reload. |
You can remove all of it at any time by clearing site data for this site in your browser's settings - in most browsers, through the padlock or information icon in the address bar. Doing so loses the remembered SQL and settings and nothing else. If you would rather nothing were kept at all, a private or incognito window discards it when you close the window.
Cookies
CsvFlex sets no cookies. Not for sessions, not for settings, not for analytics, not for advertising - there are none.
Our analytics stores nothing on your device at all - no cookie, no local storage, no identifier of any kind - so it falls outside those rules too. That is why CsvFlex has no cookie banner: there is nothing to ask you to agree to.
Analytics
We use Plausible Analytics to count how much the site is used. Two things about how it is set up matter here:
- It is self-hosted on our own server in the European Economic Area
(
plausible.vsrc.uk). There is no third-party analytics company receiving anything, and the measurements are not shared with, sold to or combined with data from anyone else. - It is cookieless and identifier-free. It does not set a cookie, use local storage, or store any persistent identifier, so it cannot follow you from visit to visit or from site to site.
For each page view it records:
- the page address on this site - which is only ever a page such as
/or/privacy, and never contains anything from your files; - the site you arrived from, if any;
- your browser, operating system and device type;
- your country and, approximately, region - worked out from your IP address at the moment of the request.
Your IP address is used only to derive the country and to produce a one-way hash that lets the same visitor be counted once rather than twice within a day. The IP address itself is never written to storage, the hash cannot be reversed to recover it, and the secret used to produce it is replaced every 24 hours, so yesterday's hash and today's cannot be matched up. The result is a count of visits, not a record of visitors.
Our lawful basis for this is legitimate interests (UK GDPR Article
6(1)(f)): we need to know roughly how much the site is used and which pages people
reach, and this is the least intrusive way we know of to find out. We have weighed that
against your interests and consider the impact minimal - no personal data is retained,
no profile is built, nothing is shared, and nothing about you is stored on your device.
If you would prefer not to be counted at all, blocking plausible.vsrc.uk
in a content blocker or your browser's settings stops it entirely, and CsvFlex works
exactly the same without it.
Server logs
Like every website, the server that hands out the CsvFlex application files keeps standard access logs. These record the IP address making the request, the time, the file requested, the response status and the browser's user-agent string. They are generated by the web server itself, not by the app, and they never contain anything you typed - only the fixed file names that make up the program.
We use them to keep the site available and secure and to investigate faults and abuse. The lawful basis is again legitimate interests. They are retained for no longer than 30 days and are not used to build any profile or combined with the analytics above.
Who handles your information
CsvFlex has no third-party services embedded in it - no advertising, no trackers, no social media widgets, no external fonts, no content delivery networks, and no third-party analytics provider. The only organisation involved besides us is the company that hosts the server, acting on our instructions under a contract, and the only information it handles is what the server logs section describes.
The servers - both the site and the analytics instance - are located in the European Economic Area, which UK adequacy regulations cover, so no transfer safeguards beyond that are needed. We do not transfer anything outside the UK or the EEA.
Security
The site is served only over HTTPS, with HTTP Strict Transport Security, so the application files cannot be tampered with in transit. Since your files stay in your browser, the strongest protection they have is the one your own device provides.
Contact
For anything about this notice, or to exercise any of the rights above, write to csvflex+privacy@vsrc.uk.