Privacy Policy

    Last updated: 8/4/2026

    FileMerger is built around a single technical decision: your files are never uploaded. Every merge, conversion and export runs inside your own browser using the File API and WebAssembly. This policy explains what that means in practice, what limited information we do collect, and what rights you have over it. We have tried to write it in plain language rather than legal boilerplate, because a privacy policy you cannot understand protects nobody.

    Your Files Never Reach Our Servers

    When you select a CSV, Excel or JSON file, the browser hands our code a reference to that file on your own disk. We read it into memory on your machine, perform the merge locally, and write the result straight back to your downloads folder. At no point is the file content transmitted over the network. You can verify this yourself: open your browser developer tools, switch to the Network tab, and merge a file. You will see no upload request.

    The practical consequence is that we cannot see your data even if we wanted to, and we cannot hand it to anyone else. It also means we cannot recover a file for you, troubleshoot a problem by inspecting your spreadsheet, or restore a merge you closed the tab on. If you are working with regulated data such as health records, payroll or customer PII, this local-only model is the reason FileMerger can usually be used without a data processing agreement.

    What We Actually Collect

    Running a website still produces some data. Here is the complete list of what we receive, all of it either aggregated or standard web request information:

    • Standard server logs from our hosting provider, including IP address, browser user agent and requested URL, retained for security and abuse prevention.
    • Aggregated usage statistics through Google Analytics, such as which pages are visited and roughly where visitors are located at country level.
    • Advertising cookies set by Google AdSense, which fund the free tier. These are covered in detail in the advertising section below.
    • A single browser localStorage entry recording whether you dismissed the cookie banner, and another storing your chosen interface language.
    • The contents of the contact form, if and only if you choose to submit one. We use this solely to answer you and do not add you to any mailing list.
    • Nothing about the structure, column names, row counts or contents of the files you merge. That information never leaves your device in the first place.

    Cookies and Local Storage

    We use two categories of browser storage. Functional storage remembers your language choice and whether you have dismissed the cookie notice; it contains no identifier and is never sent anywhere. Advertising and analytics cookies are set by Google and are subject to Google’s own policies. You can decline non-essential cookies through the banner shown on your first visit, and you can clear all of them at any time through your browser settings without losing access to any feature of the tool.

    Third-Party Services

    FileMerger loads scripts from Google Analytics and Google AdSense, and web fonts from Google Fonts. These providers receive your IP address and user agent as an unavoidable consequence of serving a request, and they may set their own cookies. We do not share any additional information with them, and because your files stay local, we have nothing about your data to share even in principle. The contact form is delivered through Supabase Edge Functions, which processes only the email address, subject and message you type.

    Google AdSense and Advertising Cookies
    Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to FileMerger or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visit to our site and/or other sites on the Internet. Users may opt out of personalized advertising by visiting Ads Settings or by visiting www.aboutads.info.

    Data Retention and Security

    Server logs are retained for 30 days and then rotated out. Contact form submissions are kept in our email inbox for as long as needed to resolve your question and are deleted once the thread is closed. Because we hold no file data, there is no file data to breach, retain or delete. The site is served exclusively over HTTPS, and the merging code runs in the browser sandbox with no access to anything on your machine beyond the specific files you explicitly select.

    GDPR & User Data Rights

    Under the General Data Protection Regulation (GDPR) and similar privacy laws, you have specific rights regarding your personal data. Because FileMerger processes all files locally within your browser and does not collect or upload your files, we do not store any personal data extracted from your files.

    However, for any standard web analytics or advertising cookies we may use, you have the right to:

    • Right to Access: Request copies of your personal data.
    • Right to Rectification: Request correction of any information you believe is inaccurate.
    • Right to Erasure (Right to be Forgotten): Request that we erase your personal data under certain conditions.
    • Right to Restrict Processing: Request that we restrict the processing of your personal data.
    • Right to Data Portability: Request that we transfer the data we have collected to another organization or directly to you.

    If you wish to exercise any of these rights or have questions about how we comply with GDPR and CCPA, please contact us at jackke88+filemerger@gmail.com.