Privacy: local JSON, static fixtures and no credential fields
How the contract lab handles pasted JSON, imported files, exports, search and hosting requests.
The lab parses and validates JSON in the browser. It asks for no API keys and sends no pasted or imported payload to a provider, analytics endpoint or application server. Bundled fixtures and the search index are static files served by the publication's managed host.
Treat the editor as a local demonstration
Pasted payloads and imported JSON remain in the current page's memory. Selecting a file reads it in the browser; it is not uploaded by the lab. Download controls create output locally for your browser to save. The application does not create an account, store your payload in localStorage or use a cookie to preserve your work. Reloading can discard unsaved edits.
Use synthetic inputs when experimenting. Your browser extensions, device software and downloaded files have their own handling outside this page's controls. There is no reason to paste an API token, authorization header, account identifier or confidential research payload into the example. The interface has no secret field and no mechanism for creating or testing a provider credential.
Understand the requests that still occur
Visiting the publication loads HTML, scripts, styles and static resources from its Cloudflare-hosted site. Choosing a supplied fixture can request that static fixture file. Search loads the site's static index and matches locally. The application does not append input JSON, search text, selected values or user identity to those resource requests, and this release contains no application analytics tracker.
The hosting service can process ordinary connection and request information to deliver and protect the website. Browser-local processing does not mean a page visit leaves no hosting record. Cloudflare's privacy policy describes its own processing. A local fixture also does not establish that an external API would permit the same browser access; the demonstration makes no such network request.
External links and publication contact
Opening an official specification, research profile or inquiry page visits a separate service. Its privacy rules apply there. Some featured links contain fixed referral parameters identifying this publication and campaign. They contain no pasted data, file contents, API secret or personal identifier. Avoid adding sensitive information to a URL when sharing a result or reporting a bug.
This notice describes the initial release behavior as of 16 October 2026. It is not a privacy certification or a representation about all software on your device. Report a concern through the publication contact identified on the About page, using the minimum information needed to reproduce the issue. Any later input storage or external-request feature would require an updated implementation and notice.
Keep in the decision record
- No API keys are requested or tested.
- Imported and pasted payloads are processed in the current browser page.
- Static hosting and external destinations still have their own request processing.
Source notes
Primary specifications support the interface descriptions. All downloadable response fixtures are synthetic. Access and rights checks are dated in the source inventory.
Version 1 · Published 16 October 2026. Inspect the method · Open the contract lab