Privacy Policy

When you paste JSON into PayloadIQ, it is processed entirely within your browser using JavaScript running locally on your device. The JSON content is not transmitted to any server operated by PayloadIQ.

This includes all transformation tools: TypeScript generation, Zod schemas, Prisma models, GraphQL types, SQL, YAML, CSV, mock data, JSON Schema, JWT decoding, Base64 encoding/decoding, schema quality checks, JSON Explainer, Contract Doctor, and Typed Client generation.

PayloadIQ makes server calls for the following purposes. None of these calls include your pasted JSON.

• Session creation — a lightweight signed session token is issued to identify your browser session and enforce the free daily limit. No payload data is included.
• Usage counting — tool switches are counted server-side to enforce the free daily limit. Only the tool name and a session ID are sent, not your JSON.
• Checkout and payments — when you initiate a payment, a checkout URL is requested from our server. Your JSON is not part of this request.
• License activation and verification — when you enter a license key or restore Pro access, the key is verified server-side. No payload data is involved.

We use Supabase (a hosted PostgreSQL service) to store:

• Session metadata (anonymous session IDs, usage counters, plan status)
• License records (license key, purchase email, device activation status)
• Payment webhook events (for license activation, not payment card details)

Supabase does not store your pasted JSON payloads.

Payments are processed by Stripe and, where available, Revolut. PayloadIQ does not store payment card details. All financial data is handled by the respective payment provider under their privacy policies.

We receive a webhook notification when a payment completes, which contains the order reference and purchase email used to issue your license key. We do not receive or store full card numbers, CVV, or billing addresses.

If Resend is configured, your purchase email address is used to deliver your license key after a successful payment. The email is also used for Magic Link restore flows (signing in to recover Pro access).

We do not send marketing emails. We only send transactional emails related to your purchase and license.

PayloadIQ allows you to share your editor state via a URL hash link (Share button). The hash encodes your current JSON input and selected tool.

Do not share URL hash links that contain sensitive or confidential payload data. Anyone with the URL can decode the JSON from the hash.

PayloadIQ does not store shared links on any server. The data lives only in the URL itself.

PayloadIQ uses PostHog as a minimal, anonymous traffic meter — essentially just a visitor and country counter — so we have a rough sense of how many people use the site and from where. We keep tracking as limited as possible: it records only anonymous page views and the country inferred from your IP address. The identifier it uses is a random first-party counter with no name, email, or account attached (a pseudonymous ID — see the analytics cookie in section 8). It does not capture the contents of anything you type, paste, upload, or generate; does not capture input fields, button clicks, mouse movement, or page-exit/engagement events; builds no advertising or cross-site profile; and screen/session recording is turned off. There is no Google Analytics, no ad network, and no fingerprinting.

PostHog is served first-party through payloadiq.dev (a reverse proxy): your browser only ever connects to our own domain, which forwards these anonymous events to PostHog Inc.’s US Cloud (the dashboard lives at us.posthog.com; events are ingested via us.i.posthog.com), acting as our data processor in the United States with the minimal settings described above. Your pasted payloads stay in your browser and never reach PostHog.

Basic server logs (IP address, request path, HTTP status) may be retained by the infrastructure provider (Vercel) for security and performance purposes, subject to their privacy policy.

PayloadIQ uses a minimal set of first-party cookies and browser local storage. There are no third-party, advertising, or cross-site tracking cookies.

Essential cookies:

• An admin session cookie, set only if you sign in to the owner-only admin page.
• A student-access cookie (piq_student), set only if you use the “I’m a student” unlock on the Students page, so your higher free daily limit persists. It contains no personal data.

Analytics cookie: a first-party PostHog identifier that distinguishes anonymous sessions for the limited usage analytics described in section 7. It stays on payloadiq.dev and is not shared with other sites.

Browser local storage (kept on your device, never sent as cookies): your signed session token (free/Pro access), an anonymous device ID (for the 3-device Pro limit), UI preferences (theme, editor zoom), a flag recording that you dismissed the founding-offer banner, and your saved workspaces and tabs.

Pro cross-device sync (optional): if you activate Pro with your license key, an end-to-end encrypted copy of your workspaces is stored on our server so your other devices can decrypt it. The encryption key is derived from your license key, which we store only as a hash — we cannot read your synced content.

You can clear cookies and local storage at any time in your browser settings; doing so resets your local session and preferences.

If you have a Pro license, your purchase email and license record are stored on our servers. You may request deletion of this data by contacting support@payloadiq.dev. Note that deleting your license record will permanently deactivate your Pro access.

Free tier users who have not purchased are identified only by an anonymous session token with no personally identifiable information attached.

For privacy questions or data requests: support@payloadiq.dev

Operator: ICS4BIZ & IT SRL, Romania · EU VAT RO40871194