Privacy policy

Last updated: 28 October 2026

This is a translation; the German version is binding.

This is a translation. The German version (Datenschutzerklärung) is binding.

Part A - For all giit Editors

A1. Controller and contact

The controller responsible for processing personal data on the website yaml.giit.ch with the YAML Editor is:

Grünwald Innovation
Sebastian Grünwald
Birchstrasse 6
8212 Neuhausen am Rheinfall
Switzerland

Grünwald Innovation is a sole proprietorship of Sebastian Grünwald.

For questions about data protection and for requests under section A15, contact us at privacy@giit.ch or at the address above.

A2. Summary

• The editors run entirely in your browser. Your documents are not sent to us; they stay on your device unless you send them somewhere yourself.
• There are no accounts, no web analytics, no tracking, no advertising and no profiling. Fonts, scripts and programs of the editors are loaded only from our own website.
• When you open the website, our hosting provider lima-city (TrafficPlex GmbH, Germany) records technical access data, including your full IP address and the address requested; these logs are kept for up to 90 days (A4).
• lima-city sets technical cookies without any personal identifier to protect against automated access (A5).
• Data leaves your device only when you use a feature for it yourself: saving to a server of your choice (webhook), loading a file from an address, pictures or other content your document refers to, an AI service or browser agent of your choice, or another website that has embedded the editor (A8 to A11).
• Under the Swiss Federal Act on Data Protection you have, in particular, the right of access (A15).

A3. Scope and applicable law

This policy applies to the website yaml.giit.ch and all its pages. Each of the giit Editors (latex.giit.ch, svg.giit.ch, html.giit.ch, md.giit.ch, json.giit.ch, yaml.giit.ch, xml.giit.ch, csv.giit.ch, typst.giit.ch) and the overview editors.giit.ch has its own version of this policy; they differ only in the details in Part B.

Processing of personal data is governed by the Swiss Federal Act on Data Protection (FADP) and the Data Protection Ordinance (DPO) and, for storage on your device, by Art. 45c of the Telecommunications Act (TCA). Part C contains additional information for people in the EU and the EEA.

Personal data is any information relating to an identified or identifiable natural person. The content of your documents may contain personal data; we do not receive it.

A4. Visiting the website: hosting by lima-city and server logs

The website is run by lima-city, a service of TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany. lima-city processes the data as our processor.

To deliver a page or file, the web server processes your device's IP address and the information your browser sends with each request. According to lima-city, it logs:

• the full IP address and the date and time;
• the domain and address requested, including the parameters in the address (the part after "?", see below);
• HTTP method, protocol version, response status, amount of data transferred and response times;
• browser and connection characteristics, in particular the browser identifier (user agent), language settings and technical characteristics of the encrypted connection;
• technical security information, such as the reason for a block;
• an access ID that allows a single request and related error messages to be found.

The IP address in the access logs is neither shortened nor anonymised.

Purpose: delivering the website, investigating faults, and detecting and preventing misuse, bots and attacks. We do not analyse the logs to recognise visitors and do not combine them with other data.

Retention (as stated by lima-city):

Parameters in the address. If you open a link that contains information after a "?", such as ?src= (load a file from an address), ?webhook= (save target) or ?lang= (language), this information reaches our server with the request and ends up in lima-city's access logs, even though the editor removes it from the address bar immediately afterwards. If such a link contains an access token, the token is logged as well. Information after a "#", by contrast, never reaches any server (A10).

Location and disclosure abroad: The website and its logs are run in the Telehouse data centre in Frankfurt am Main, Germany (lima-city web hosting package "Mini"). Backups of the website files are kept by Hetzner in Helsinki, Finland; the website files contain no personal data of visitors. According to the decision of the Federal Council (Annex 1 DPO), Germany and Finland provide an adequate level of data protection.

lima-city's current information is at https://www.lima-city.de/hilfe/welche-daten-speichert-lima-city-von-webseitenbesuchern.

A5. Cookies and storage in your browser

We do not set any cookies ourselves. The editors keep your work and settings in your browser's local storage (A6). Our hosting provider, however, sets the following cookies for its bot protection:

The value of these cookies is the same for all visitors and contains no personal identifier. They serve only to distinguish automated requests from ordinary browser visits and so protect the website against attacks. They apply only to yaml.giit.ch.

You can refuse or delete cookies in your browser settings. Because the cookies serve the security of the website, there is no guarantee that the bot protection will let requests through without them.

A6. Your documents stay in your browser

The YAML Editor is a program that runs entirely in your browser. What you write, open, paste or export is processed on your device and not sent to us. We have no access to it.

So that your work is not lost when you reload the page, the editor stores in your browser's local storage (localStorage, and IndexedDB for some editors; details in Part B):

These entries do not leave your device. They are needed for the function you use (keeping your documents and settings) and contain no identifier that could recognise you. You can remove them at any time: single documents in "My documents", everything at once in your browser settings ("Clear site data"). Your documents are then gone for good. If you want to refuse the storage, use the editor in a private window or block storage for yaml.giit.ch in your browser; the editor then cannot keep your work.

The browser may delete stored data on its own, for example when storage runs low or in private windows. Keep important documents as a file as well.

A7. Between your browser tabs and in the clipboard

If the editor is open in several tabs, the tabs exchange short messages through a channel of your browser (BroadcastChannel), for example which tab was used last, and hand a document from an AI link to that tab. These messages stay in your browser.

"Copy prompt" and other copy functions put text on your clipboard. Nothing is sent.

A8. Saving to your own server (webhook, optional)

If you enter an address under "Save to server", or open a link with ?webhook= and allow saving, the editor sends the document directly from your browser to that address when you save - if you wish, also automatically shortly after each change: editor, ID, name, content, time of change and, depending on the editor, the document's pictures and files (Part B). If you entered an access token, it is sent too.

We do not receive this data. The operator of the server you send it to is responsible for its processing. An address and access token you enter yourself stay stored in your browser (A6); values from a link or from an embedding website are kept in memory for the session only. For links with ?webhook= see also A4 (parameters in the address).

A9. Files from an address and content your document refers to

File from a link. If you open a link with ?src=<address>, your browser loads the file from that address without sending cookies. The server at that address receives your IP address and the usual browser information; its operator is responsible for it.

References in the document. Depending on the editor, your document may refer to pictures or other content on other websites (e.g. an https address). So that the preview can show them, your browser loads them from there; that website receives your IP address, the usual browser information and, as origin, the address of our website (without path). Whether this happens depends on the content of your document, not on us. Part B lists the editors concerned. The operators of those websites are responsible for their processing.

A10. AI assistant (optional)

"Copy prompt" puts instructions and your current document on your clipboard. The editor sends nothing. If you paste the text into an AI service of your choice, that service processes it under its own terms and privacy policy; the provider of the AI service is responsible for that, not we. Do not paste content you do not want to entrust to that provider.

The AI answers with links that carry the document after the "#" sign. Browsers never send this part of a link to a server, so the document does not reach us when you open such a link. If the AI delivers a document in several links, the editor keeps the parts until all of them are there (A6).

A11. Browser agents (WebMCP, optional)

If your browser offers an AI agent that can operate websites through the WebMCP interface, the editor provides it with tools: read and change the document, show problems, list, open and create documents. Such an agent can therefore read and change all documents in "My documents", not only the open one. Whether and how the agent sends this content to its provider is decided by your browser and the agent's provider under their own terms; they are responsible for it. The editor itself sends nothing to any server.

A12. Embedded in other websites

Other websites can show the editor in a frame or a window of their own and exchange documents with it. The editor's pages are still loaded from our server (A4, A5). Only the document the embedding website handed to the editor, and changes to it (content, name, pictures and files, for some editors also a PDF), go back to that website - never your other documents.

An embedding website can also give the editor an address and a key for AI results. The key is kept in memory only until the session ends and appears in plain text in the copied prompt; with the prompt it reaches the AI service you choose. The AI sends its result to the embedding website's server.

The operator of the embedding website is responsible for all data that website receives; its privacy policy applies. We do not receive this data.

A13. Contact by email

If you write to us, for example at privacy@giit.ch or info@giit.ch, we process the data you send (address, name, content) to answer your request. Our mailboxes are hosted by Microsoft (Microsoft 365), which acts as our processor. The contracting party is Microsoft Ireland Operations Limited, Dublin, Ireland; the mailboxes are kept in data centres in the EU/EEA. For support and operations Microsoft may disclose data to the USA, on the basis of Microsoft's Products and Services Data Protection Addendum with standard contractual clauses and the certification of Microsoft Corporation under the Swiss-U.S. Data Privacy Framework.

Emails are not deleted automatically; they are kept for later contact. You can ask for deletion at any time (A15).

A14. Disclosure, data security, no automated decisions

We do not sell personal data and do not pass it on to third parties. The only recipients are the processors named (lima-city with its sub-processors for hosting, Microsoft for email) and authorities where we are legally obliged.

The website is delivered over encrypted connections (HTTPS) only. A browser security policy (Content Security Policy) prevents the editors from loading scripts from other servers.

There are no decisions based solely on automated processing and no profiling.

A15. Your rights

Under the FADP you can in particular:

• request access: whether and which personal data about you is processed (Art. 25 FADP). Access is generally free of charge and is given within 30 days. Send your request in writing or electronically to the address in A1;
• request delivery of the personal data you disclosed to us in a common electronic format, where the conditions of Art. 28 FADP are met;
• request rectification of incorrect data (Art. 32 para. 1 FADP);
• request that a particular processing or disclosure be stopped or that data be deleted (Art. 30 para. 2 let. b and Art. 32 para. 2 FADP).

To find data in the server logs we need information such as the IP address and time of access; without it we cannot attribute log entries to a person. Your documents in the browser are only with you; you can view and delete them yourself (A6).

If you believe that we are not processing your data lawfully, you can contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) and file a report there (Art. 49 FADP).

A16. Changes

We update this policy when the editors, the services used or the law change. The version published on this page with its date applies.

Particulars of this editor

YAML Editor (yaml.giit.ch)

• Stored: documents and settings in localStorage (yamleditor.*); the settings yamleditor.v1 hold the open document and the layout of the areas. No IndexedDB.
• Saving on a server (A8): the name and content of the document.
• Content from other websites: none. The editor loads no schemas a document refers to and nothing named in YAML tags or comments.

Part C - Additional information for persons in the EU and EEA

Grünwald Innovation has no establishment in the EU. Where the EU General Data Protection Regulation (GDPR) applies to the processing described in Part A (Art. 3(2) GDPR), the following applies in addition:

• Controller: as in A1. We do not target our services specifically at people in the EU and have not appointed a representative in the Union.
• Purposes and legal bases (Art. 6(1) GDPR):
• Server logs and bot-protection cookies (A4, A5): point (f); our legitimate interest is the secure and uninterrupted provision of the website and the prevention of attacks.
• Storage in the browser (A6): the entries are strictly necessary for the editor to provide the function you request; we receive no personal data from them.
• Contact by email (A13): point (f) (answering your request), for requests about a contract point (b).
• Recipients and third countries: lima-city (TrafficPlex GmbH, Germany) as processor; Microsoft Ireland Operations Limited for email (A13). We are based in Switzerland, for which the European Commission has adopted an adequacy decision.
• Retention: as stated in A4, A6 and A13.
• Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing under Art. 6(1)(f) on grounds relating to your particular situation (Art. 21 GDPR).
• Complaint: you can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence (Art. 77 GDPR).
• Obligation to provide data: the data under A4 is technically necessary to open the website; without it the website cannot be delivered. Other data is voluntary.
• Automated decisions: none (Art. 22 GDPR).