Local XML editing with optional assistance.

Last updated: 28 October 2026

This policy covers XML File Tools, the separately installed XML Editor desktop app and optional browser extension usage statistics, operated by Ship It! Software Limited. The website, desktop and extension practices are described separately below.

Local file handling

Selected files, pasted XML, parsed values, edited source, attached schemas and DTD resources, queries, stylesheets and generated outputs are processed on your device. Local editing does not intentionally transmit document names, paths, XML element or attribute names, values, document contents, schemas, queries or stylesheets to our servers or include them in analytics or diagnostics. Optional assistance is a separate explicit action described below. No account is required for local editing. The sample is embedded in the application. Local engine resources are bundled with the application; attached resource URI aliases do not authorize network or arbitrary filesystem fetching.

Optional XML assistance

When configured, Assistance sends your goal and source text you explicitly select and include through this product's server to OpenRouter and the configured model provider. The interface shows the included text and configured model identifier. Attached schemas, local resources and unselected source are not automatically sent. Checking availability sends no document contents. Avoid including sensitive information you do not want those services to process. Service providers receive ordinary network information and apply their own processing and retention terms; no fixed provider retention period is promised here. The server requests restricted data collection and zero data retention; unavailable provider admission fails closed.

Desktop versions with local assistance can instead use Ollama at 127.0.0.1:11434 after you explicitly refresh downloaded models and connect one. Only your goal and checked source go to that endpoint. The Ollama service controls processing beyond the endpoint; use downloaded models and disable Ollama cloud features for local-only processing. The app does not install the service or download models. Changing providers, models, source or schema revokes selected context and draft authority.

Generated source changes remain untrusted drafts. They must match the selected original text and pass local language and configured schema validation. Source, revision, selection and schema changes invalidate review authority. Apply is explicit and undoable, and does not save the source file. Cancelling prevents a later local Apply but cannot retract information already transferred. Provider credentials remain server-side. Local editing works without assistance; installed app and extension releases may have different feature availability.

Website handoff storage

Opening a file, pasted XML or a sample stores its original input in browser-local IndexedDB when available. Each handoff expires after 30 minutes and is no longer eligible for restoration after expiry. Expired records are cleaned up during later use; expiry does not guarantee physical deletion at that exact time. If storage is unavailable, the input stays in page memory for the current visit.

Input handoffs above 64 MiB in total stay in the current tab without copying the whole source into browser storage. This recovery-storage threshold is separate from each tool’s file-size limits. Reopen the original after refreshing, and download changes before closing the tab.

Editor sessions and desktop files

The website editor saves bounded portable XML sessions in IndexedDB when available; existing localStorage sessions remain readable during migration. The installed desktop app retains its existing optional app-webview session recovery. Large source preview tabs are excluded from portable snapshots, and native files remain on the filesystem. Settings can include authored schemas, DTD resource catalogs, queries and stylesheets. These sessions have no automatic expiry. Closing the tab or app does not erase stored XML. Clear this site's browser data or the installed app's local webview storage to remove these records. Save important documents and projects before clearing data. Native filesystem handles and source-write permissions are not restored from these portable session records; reopen a local source to grant access again.

The desktop app reads files you select or open through the operating system. Saving writes to the authorized local source or selected destination and may use temporary local staging files. Exported copies use a separate selected destination. Local sessions and separately saved files remain on your device; clearing session storage does not delete separately saved files. Snap permissions limit accessible locations on Linux. XML Editor does not monitor Downloads or configure sign-in startup.

Ordinary web request data

Loading website pages, policies, scripts, styles and the favicon sends normal technical request data to Cloudflare, such as IP address, browser details, requested path, time and security signals.

Purposes, cookies, and analytics

Website request data is used to deliver and secure the site and diagnose availability. The website does not currently set analytics cookies, create advertising profiles or run product analytics. The installed desktop app has the separate analytics and diagnostics described below.

Desktop analytics and diagnostics

Desktop releases incorporating the 25 October 2026 reliability update send bounded usage events to PostHog for app starts, successful document opens, the first successful edit of a document, and successful saves. Earlier installed releases retain their previous measurement until updated. Sentry receives application lifecycle and unexpected error diagnostics. Reports include fixed app, installed-version, platform, build-provenance, action, source and outcome categories, with sanitized technical diagnostics. They exclude file names and paths, document contents, schemas, field or column names, cell values, SQL, credentials and arbitrary error text. Debug builds suppress routine remote telemetry; locally built release packages can report development-tagged activity. A failure to deliver a report does not prevent local editing.

Updated desktop apps also keep bounded local lifecycle and panic-category logs for troubleshooting, without document contents, paths or arbitrary error text. Clearing local app data can remove local diagnostic logs and the routine installation identifier; it does not erase reports already received.

Analytics uses a random identifier for this app installation stored in local webview storage and a fresh random session identifier held in memory for each launch. Neither identifier comes from an account, hardware, operating-system identity or document. If local storage is unavailable, analytics uses an explicit session identifier instead. PostHog person-profile creation is disabled.

PostHog and Sentry receive ordinary network information, including IP addresses, when reports are sent. The configured desktop collection endpoints are in the United States. PostHog can retain IP addresses and derive approximate location from them; this does not request your device's precise location. Random identifiers and disabled person profiles do not make these reports anonymous.

Service providers and retention

Cloudflare hosts and protects the website. PostHog receives the desktop analytics, and Sentry receives desktop diagnostics described above. We retain technical, analytics and diagnostic records as reasonably needed for reliability, security and legal obligations, subject to service-provider retention controls. These providers may also retain information under their own operational policies. No fixed retention period is promised here.

The desktop installation identifier remains in local app storage until that storage is cleared; a later launch may create a new identifier. Clearing it does not erase reports already received. Session identifiers are held in memory. The current desktop editor has no in-app analytics opt-out. Operating-system network controls can restrict connections; failure to deliver telemetry does not prevent local document editing.

Security and choices

Local processing limits exposure, but no software or network service is risk-free. Keep backups and check saved outputs. You can clear browser or app storage to remove local sessions. For privacy questions, use the contact route described on our support page without including private document contents or credentials. Connected Loam services have their own data-handling information.

Optional browser extension usage statistics

If you enable optional usage statistics in an extension version that offers this setting, the extension sends limited usage events to PostHog in the United States to help us understand use and reliability. Share usage statistics is off by default in extension Options. Local file tools work when it is off. Firefox versions also require the browser’s optional technical and interaction data permission before sending events.

Events count workspace opens, successful file opens, exports and failed file opens. They include fixed product, browser and extension version fields and a random installation identifier created and stored on your device only after you opt in. They exclude file contents, file names, URLs, searches, edits and raw error messages. We do not use session replay, automatic interaction capture, analytics cookies or referrer collection.

PostHog receives ordinary network information, including your IP address, when an event is sent. IP-based location enrichment is disabled for these extension events. A random installation identifier does not make the reports anonymous. Events are retained according to our PostHog project retention settings, subject to earlier deletion under provider controls or an applicable request.

Turning Share usage statistics off stops future events and deletes the local installation identifier. It does not delete events already received. Enabling it again creates a new identifier. This setting applies only to the separately installed extension and does not change website or desktop settings.

Changes

We may revise this policy as the utility changes. The date above identifies the current version. Material behavior changes will be reflected here.

Use of the utility is also subject to the Terms. For privacy questions, visit Support.

Optional XPath drafting prepares context locally. Vocabulary names, root namespace bindings and URIs, diagnostics, the current expression and an exact selected XML sample each require separate explicit inclusion. All start off; diagnostics, expressions and samples can contain source values. Only your goal and chosen previews enter the configured provider request. File names, paths, native grants, the full source and attached schema resources are not attached automatically. Local draft review parses a conservative supported XPath subset without executing it. Manual Use and the separate local Evaluate XPath command remain distinct.