Last updated: October 18, 2026
This Privacy Policy describes how Ship It! Software Limited ("Company", "we", "us") collects, uses, discloses, and protects information when you visit or use Parquet Viewer and the Parquet Editor desktop and mobile apps. It is incorporated into our Terms of Service.
Parquet Viewer MCP
If you separately connect and authorize the Parquet Viewer MCP, the client sends its prompts, read-only SQL, and tool arguments to the MCP resource. The service processes the governed schemas, selected column profiles, bounded query results, and authorization data required for the operation. This MCP cannot edit rows or tables. Your authorized workspace, current permissions, OAuth authorization, and revocation state determine access on every request.
Optional account
You do not need to sign in to use this site or its file tools. If you choose Log in or sign up, your browser redirects to our shared account sign-in and consent service, provided using Supabase Auth. After you approve access, this site receives your account identifier and, when available, your email address and display name to display the optional account session.
The server discards account access, refresh and ID tokens after retrieving your identity. It encrypts the bounded identity details and expiry in an HttpOnly, SameSite=Lax cookie lasting up to one hour and scoped only to this site. A separate encrypted cookie holds login state for up to ten minutes. Account details are not placed in local storage, session storage, analytics or operational telemetry.
You can continue anonymously, decline consent or log out at any time. Logging out clears this site's account cookie and does not sign you out of the shared account service or another microsite.
Your Parquet data
In the local viewer, opening a selected file reads it in the current tab. Filtering, sorting, schema inspection, and local CSV export happen in your browser. Those local viewer actions do not send a selected filename, schema, column name, cell value, or generated CSV to an analysis service.
File entry for the local viewer also stores the original input locally in this browser’s IndexedDB when available. Each handoff expires logically after 30 minutes and is cleaned up on later use; browser site-data controls can clear it sooner. Stored originals may remain after the tab closes until cleanup or site-data removal. If storage is unavailable, entry uses memory in the same tab. Back to page and Resume keep edited data and settings in this tab’s mounted workspace; reload restores only an unexpired original input. Download edited files before reloading or closing the tab. File contents are not sent to a server by this handoff.
Analyze with SQL works differently. For each analysis, this site's server uses a private service credential to create one ordinary private leased Namespace. The service-account key stays on the server and is never sent to your browser.
The service returns a reveal-once analysis token that is valid only for that exact Namespace. The page holds the token only in memory and sends it explicitly with analysis requests. It is not placed in a cookie, local storage, session storage, a URL, or a log, and it is lost when the page reloads or closes.
You can add multiple Parquet files to the analysis. Your browser uploads each file directly to private analysis storage using a time-limited signed upload, and the service creates one ordinary table per file. SQL can query or join those tables. The service receives the uploaded file contents, table names, and SQL statements needed to perform the analysis and return its results.
The private Namespace lease expires after 24 hours by default and never more than seven days after creation. Activity does not extend this fixed expiry. Expiry revokes access and schedules physical cleanup. We do not use file contents to train an AI model.
Server conversion
Parquet to CSV starts processing as soon as you choose or drop files, including files added with Add more files. Their contents are sent in chunks to private processing storage. Our servers read the files and create temporary CSV outputs. Local filenames are not sent as conversion job metadata. When you download a result, the requested CSV filename is sent only to create its temporary download link.
The page keeps each conversion's private access key only in memory. It is not placed in a cookie, browser storage, analytics or a URL. Download links grant temporary access to one CSV file; keep them private. Reloading or closing this tab loses access to its queue and downloads, while submitted background jobs may continue.
Conversion access expires 24 hours after the job is created. Uploaded chunks and generated CSV files are scheduled for automatic deletion after expiry. Cancelling a job stops publication and schedules deletion of its uploaded chunks and output. An already issued upload or download link can remain usable until its short expiry or object deletion; late uploads are removed during automatic cleanup. Download the CSV files you need before expiry. We do not use file contents to train AI models.
Parquet Editor desktop app for Windows and Linux
The separately installed Parquet Editor desktop app for Windows and Linux opens, edits, queries, and saves files on your computer. Local document operations do not require an account or upload file names, paths, schemas, column names, rows, cell values, file contents, or SQL to us. Document processing works without a network connection.
Production builds send privacy-bounded application lifecycle logs and unexpected crash or error diagnostics to Sentry, and bounded operational events to PostHog to understand app use and improve reliability. Routine measurement covers application and session lifecycle, document operations and views, setup and preferences, operating-system integrations, and reliability and outcomes. Events include app and release information, fixed action, source and outcome categories, a random app-scoped installation identifier kept in local app storage, and a fresh identifier for each launch. They exclude file names, paths, schemas, column names, rows, cell values, file contents, SQL, and free-form errors, and do not create a person profile. Debug builds do not send desktop telemetry; locally signed release builds can. A failure to deliver telemetry does not prevent document operations.
The installation identifier is not derived from your account, hardware, operating-system identity, or files. If identifier storage fails, analytics use a session identifier instead. Desktop requests expose ordinary network information, such as an IP address, to Sentry and PostHog. PostHog retains IP addresses and derives approximate location, which can include country, region, city, postal code, and estimated coordinates. The app does not request precise device location. Random identifiers and the absence of person profiles do not make these records anonymous.
Desktop support requests are delivered through PostHog. The in-app support dialog requires a reply email address and a nonempty message. Both are sent only when you choose Send request; opening or cancelling the dialog sends no support request, and the app does not read or attach files automatically. These deliberately submitted fields are kept in our PostHog support records without creating a person profile. They are not saved locally by the form or included in routine desktop analytics or crash diagnostics. Do not include private file contents, credentials, or access tokens.
On Windows, after its first launch, the background opener checks enabled folders for new Parquet files and opens them locally. Downloads is the initial watched folder. Windows local file browsing initially scans Downloads, Documents, and Desktop, where available. On Linux, folder scanning and automatic opening start without any configured folders; you can select folders in Settings and enable their browsing or automatic opening. Browsing shows up to 100 recent Parquet files directly inside each enabled folder. These checks do not scan subfolders or upload folder listings or files. You can choose or remove folders, control browsing and automatic opening separately for each folder, or turn automatic opening off in Settings. Windows startup after sign-in depends on your Startup Apps setting. Snap permissions also limit accessible locations; removable media requires the optional removable-media connection.
Selected folder locations, access settings, automatic-opening preferences, and watcher status stay in local app storage. File lists are held in app memory. Local interface preferences and the installation identifier may remain after the app exits until you clear the app's local data. Settings let you remove saved folders and disable their browsing or automatic opening; this does not delete the original files. Unsaved document changes and edit history are held in the current session, so save a copy before closing. Files you save remain on your device until you move or delete them.
Sentry and PostHog may retain desktop diagnostics and operational records for the periods needed to investigate failures, support the app, and understand reliability. This policy describes stable data categories and purposes rather than every feature or event name. New categories of collected information, recipients, or materially different uses require a policy update.
Personal data we collect
Loading a page, policy, favicon, or public sample makes a normal request to the hosting service. Its infrastructure can process standard request details such as time, requested path, IP address, and browser information for delivery, reliability, and security. Public sample files are site assets, so requesting one also tells the server which sample path was requested.
The utility also reports a small allowlisted set of operational outcomes, such as whether parsing, export, or SQL analysis succeeded, together with fixed upper-bound size and duration buckets and a coarse error category. Operational telemetry never contains analysis tokens, signed upload URLs, required upload headers, SQL text, row data, local file names, or table names. It also excludes schemas, column names, cell values, free-form error text, user identifiers, persistent browser identifiers, login state, account subjects, email addresses, and display names.
How we use personal data
We use ordinary request data to deliver and secure the site, prevent misuse, diagnose failures, and understand operational reliability. We do not sell personal data.
Product analytics measurement
We use PostHog to count canonical page views and coarse operational outcomes so we can understand use and reliability. The browser sends each bounded event to this site, which forwards it to PostHog. Each event contains a canonical path, fixed site and browser context, validated outcome fields or coarse numeric buckets, and a random in-memory session identifier that resets on reload and is not stored in a cookie or local storage.
Product analytics creates no cookie or persistent visitor profile. Event fields exclude query strings, referrers, IP addresses, analysis tokens, signed upload URLs, required upload headers, SQL, local file names, table names, file contents, schemas, column names, rows, cell values, and free-form errors. Local viewing stays in your browser. Files you upload for conversion or SQL analysis are processed by our servers as described above. PostHog is configured to discard IP data and not create person profiles from forwarded events.
Cookies and Product analytics
Parquet Viewer does not set a Product analytics cookie, store a Product analytics identifier in local storage, or run advertising trackers. Its allowlisted operational events are sent without a user or persistent browser identifier and contain only enums and fixed numeric buckets. Hosting infrastructure may use necessary request data to deliver and protect the site. If these practices change, we will update this policy before the new collection begins.
Service providers
We use hosting and content-delivery providers to serve pages and public sample files. They may process ordinary request data on our behalf under their own security and data-protection obligations. Local viewing does not send selected Parquet contents to them. Analyze with SQL uses private object storage and analysis infrastructure. Parquet to CSV uses private processing storage and conversion servers. Optional login or signup uses our shared authentication and consent service, provided using Supabase Auth, to process the login request and the bounded account details described above. Microsoft supplies the Store badge shown on this site. Loading it sends ordinary browser request data to get.microsoft.com; clicking it can request a Microsoft Store installer. The badge does not send your Parquet file contents to Microsoft.
Retention and security
Browser-local Parquet data is not retained by us. Each SQL analysis Namespace is private and kept only until the fixed lease expiry described above, followed by asynchronous physical cleanup. Hosting providers may retain ordinary request data and the allowlisted operational events in logs for limited periods needed for security and reliability. The optional identity cookie lasts for up to one hour, and the in-progress login cookie lasts for up to ten minutes. We use reasonable safeguards, but no website or transmission method is completely secure.
Your choices and rights
You can use the site without selecting a file and without logging in. You can decline consent or log out to clear this site's identity session. Browser settings can restrict cookies and other storage. Depending on where you live, you may have rights to ask about, correct, or delete personal data we hold. Ordinary request logs may not always be attributable to you.
Policy changes
We may update this policy when the utility or its data practices change. The date above shows the latest revision. Material changes will be described here before they take effect where practical.
Parquet Editor for iOS and Android
The separately installed mobile editor processes the files you choose on your device. File contents, file names, paths, sheet or column names, cell values and formulas are excluded from routine analytics and diagnostics. Local editing does not upload your document to our servers or authorize a connected assistant to access it.
The operating system's document picker grants access to the document or destination you select. The editor may keep working copies and temporary save data in its private app storage. Saving or exporting writes to the destination you choose. If you select a cloud-backed file provider, that provider handles its own transfer, access and retention under its policies. Keep a saved copy of your changes; private working storage is not a backup. Clearing app data or uninstalling can remove private working copies and preferences, but does not delete files you exported to other destinations.
Production mobile builds use PostHog for bounded application activity and Sentry for lifecycle and error diagnostics. Reports include fixed app, version, platform, action and outcome categories, sanitized technical diagnostics, a random app-scoped installation identifier stored in local webview storage, and a fresh session identifier for each launch. The installation identifier is not derived from your account, hardware or documents. If local identifier storage is unavailable, analytics uses a session identifier. PostHog person-profile creation is disabled. Debug builds do not send this production telemetry.
PostHog and Sentry receive ordinary network information when reports are sent. The configured collection endpoints are in the United States. PostHog can retain IP addresses and derive approximate location from them; this is not a request for precise device location. Random identifiers and the absence of person profiles do not make these reports anonymous. Failure to deliver a report does not prevent local document editing.
The installation identifier remains in local app storage until that storage is cleared. Clearing local app data can cause a new identifier to be created on a later launch and does not erase reports already received. Operational reports are retained as reasonably needed for reliability, security and legal obligations, subject to service-provider retention controls. The current mobile editor has no in-app analytics opt-out control; operating-system network controls can restrict connections.
If you deliberately submit a support request, the message and reply address you provide are sent to PostHog support records. Opening or cancelling a support form does not send a request, and the editor does not automatically attach files. For privacy questions or requests about reports already received, use our support form and include a request reference when available; do not send private document contents or credentials.