---
title: "Privacy"
description: "What IntoSQL collects, why, who processes it and how to get it deleted. Files you convert on the site never reach our servers."
canonical: https://intosql.com/privacy
last_updated: 2026-10-17
---

# Privacy

IntoSQL runs intosql.com. This page says what we collect and what we do with it. Write to alfonso [at] vexilo [dot] com with any question or request.

## Files you convert

The converter on the site runs in your browser. Your spreadsheets, CSV, JSON and SQL files are read and converted on your computer, and they are never uploaded to us. The command line and the desktop app work the same way: files stay on your machine unless you load them into a database you choose.

Remote conversions are the exception. A file you convert through the API or the hosted MCP server is uploaded to our storage and converted on our servers. Its input and its result are deleted 24 hours after the conversion is created, or as soon as you delete or cancel it.

When a file didn't convert well, you can send it to us so the converter learns to read it. Nothing is sent unless you agree each time. We keep the report, and the file only if you chose to include it, for 90 days, and use them only to fix the converter. Write to alfonso [at] vexilo [dot] com to have one deleted sooner.

## What we collect

| What                                                                                                                         | Why                                          | How long                                 |
| ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------- | ---------------------------------------- |
| Page views, counted without cookies and without storing your IP address                                                      | To know which pages people use               | Only as totals that can't identify you   |
| Error reports from the site and the converter: the error, the browser and the page, never file contents                      | To find and fix what broke                   | Up to 90 days                            |
| Your email address, if you give it to us                                                                                     | To answer you, or to send what you asked for | Until you ask us to delete it            |
| Your account, if you create one: email, name, linked Google or GitHub account, passkeys, password hash and security settings | To let you sign in                           | Until you delete the account             |
| The browsers you are signed in on: IP address, browser and last activity                                                     | To show you where you are signed in          | Until you sign out or delete the account |
| Sign-in links we email you                                                                                                   | To sign you in                               | A day after they expire                  |
| Server logs: IP address, address requested, time                                                                             | To keep the site running and stop abuse      | 14 days                                  |

We don't sell data, we don't show ads and we don't use tracking cookies. The site sets only the cookies it needs to work: your session, your language and your theme.

## Who processes it

These services process data for us, under contracts that limit them to doing so:

- **Cloudflare:** network, DNS and file storage.
- **Our hosting provider:** the servers that run the site.
- **Sentry:** error reports.
- **Google Analytics:** cookie-free page counts.
- **Postmark:** the emails we send.
- **Google and GitHub:** only if you choose to sign in with them; they tell us your name and email address.

## Your rights

You can ask for a copy of your data, a correction or its deletion at any time by writing to alfonso [at] vexilo [dot] com. If you have an account, you can download your data and delete the account yourself in its settings; deleting it removes everything above at once. We answer within 30 days. You can also complain to your data protection authority.

## Changes

When this page changes, the date at the top changes too. If a change affects how we use data you already gave us, we tell you by email first.