Compare Text Privacy

What happens to the text you paste

By default, nothing leaves your machine. The diff runs as JavaScript inside the page you have open. The two text panes are read into memory, compared, and the result is drawn back into the page. There is no upload step, no server-side processing, no background sync. The one exception is the Share button, which only ever runs when you click it — see Sharing a diff below.

The JSON diff page parses your input with your browser's native JSON.parse. The text diff page reads files via the FileReader API, which is also entirely local. Same goes for every other tool on the site.

You can verify this in three minutes: open the browser's DevTools, switch to the Network tab, paste two pieces of text into either tool, and watch what gets requested. You will see telemetry requests to Google Analytics and Microsoft Clarity — the usage measurement described below — but no request carries the text you pasted. Unless you click Share, your input stays in the tab. If you ever see it leave the browser otherwise, file an issue and we will fix it.

What we collect

The site is hosted on Cloudflare Pages. Cloudflare logs standard HTTP request metadata (IP address, user-agent, request URL, timestamp) for every page load — the same kind of log every web server keeps. That data is used for DDoS protection and basic operational visibility, not for building a profile of you. We do not run a CDN-level analytics product on top of those logs.

We use two third-party services to understand how the site is used: Google Analytics and Microsoft Clarity. Google Analytics gives us aggregate usage statistics — page views, referral sources, approximate location, device and browser type. Microsoft Clarity records interaction signals such as clicks, scrolls, and cursor movement to produce heatmaps and session replays that help us find usability problems. Both services set cookies and process your IP address on their own infrastructure; see the Google Privacy Policy and the Microsoft Privacy Statement for how they handle that data.

These scripts measure how the site is used — they are not part of the diff engine. The comparison itself still runs entirely in your browser, and the text you paste is never sent to our servers. If you prefer not to be counted at all, an ordinary content blocker or your browser's built-in tracking protection will block both scripts, and every tool on the site keeps working normally without them.

Advertising

The site carries ads served by Google AdSense, which is what keeps it free to use. Google and its partners use cookies and similar identifiers to serve and measure those ads, and — depending on your settings and location — may personalise them based on your prior visits to this and other sites. We do not hand Google anything about you ourselves; the ad script talks to Google directly from your browser.

The ad units sit in the page layout around the tools. They have no access to the editor panes: the text you paste is never read by the ad script, never sent to Google, and is not used to target what you see. Ads are chosen from the page you are on and your own Google settings, not from your input.

You can control or turn off personalised advertising at My Ad Center, and read how Google uses data from sites that use its services in Google's partner-sites notice. Our advertising relationship is declared in our ads.txt file. A content blocker will remove the ads, and every tool on the site keeps working without them.

Cookies and local storage

Google Analytics and Microsoft Clarity set their own cookies (such as _ga, _clck, and _clsk) to distinguish returning visitors and group interactions into sessions, and Google AdSense sets advertising cookies as described above. If you sign in, we set one session cookie for your account. Beyond those, the site sets no cookies of its own. Some pages may remember your last chosen UI preference (for example, an editor theme) in localStorage, but that data lives only in your browser and is never read back to a server. You can clear all of it any time from your browser's site-data settings.

Sharing a diff

The Share button is the one place where your text is deliberately sent to a server. When — and only when — you click it, the contents of both panes are posted to our API at api.comparetext.org and stored so that anyone with the resulting link can open the same comparison. The link contains a random identifier only; your text is never encoded into the URL.

You choose how long a shared diff lives when you create it — from one week up to one year — and it is deleted automatically when that window expires. If you are signed in, shared diffs also appear in your account, where you can delete any of them immediately. Anyone holding the link can read the diff until it expires, so treat a shared link as public: do not share a diff containing secrets you would not paste into a public page.

If you never press Share, none of this happens, and no copy of your text exists anywhere but your own browser.

Accounts

Signing in is entirely optional and only needed if you want to keep a list of the diffs you have shared. You can register with an email address and password, or sign in with Google. In either case we store your email address and a session cookie — that is all. Your account is not used for advertising, and we do not send marketing email. If you never sign in, we hold no account data about you at all.

If you upload a file

Clicking Upload on either pane uses the browser's File API to read the file's contents into the editor. The file is read locally and the bytes never leave your machine. Loading a file involves no XHR, fetch, or WebSocket.

If your file is sensitive — a contract, an internal log, an IAM policy — that is fine. The tool was built with that case in mind. The risk profile of opening an AWS IAM policy in Compare Text is the same as opening it in a local text editor: it stays on your machine, unless you choose to share it.

Search engine and AI crawlers

Our robots.txt permits crawling by Googlebot, Bingbot, GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, Applebot-Extended, Amazonbot, and Bytespider. They crawl the published pages — the static marketing copy, FAQs, and documentation — so the site shows up in search and gets cited by AI search engines. They do not see any text you paste into the diff editor, because that text exists only in your local browser session, not in the published HTML.

Children's privacy

The tool is general-purpose and does not target children. We do not knowingly collect personal information from anyone, child or adult, since the site does not collect personal information at all.

Changes to this page

If we change anything material — new infrastructure provider, new third-party script, anything that affects the "your text does not leave your browser" promise — we will update this page and bump the date at the top.

Verifying these claims

Privacy claims that cannot be verified are not worth much. The good news is that you do not have to take our word for any of the above. Open your browser's DevTools, switch to the Network tab, paste two pieces of text into either tool, and watch what gets requested. You will see telemetry requests to Google Analytics and Microsoft Clarity endpoints — that is the usage measurement described above. What you will not see is any request carrying the text you pasted, unless you click Share, which uploads it on purpose. If your input ever leaves the browser without you asking it to, the claim on this page is wrong and we want to know.