Your JSON is yours.

01What never leaves your device

QDev is a browser extension. Opening a file, browsing the tree, inferring the schema, viewing the graph, fuzzy-searching, and running jq all happen locally in your browser tab. None of it touches a network.

• Your actual values — every string, number, and nested object
• The full document, at any size
• jq queries you type and their results

jq itself runs in a sandboxed Web Worker. It's a purely functional language with no network, file, or DOM access — a query physically cannot exfiltrate your data.

02What the AI sees (hosted tier only)

When you ask a question in plain English and you're on the hosted (Pro) tier, QDev does not send your JSON to a model. Instead it sends a small, bounded payload so the model can write a jq query:

• The inferred schema — field names and types, no values
• Your natural-language question

That is the entire payload — no values, redacted or otherwise, ever leave your tab. The generated jq then runs locally on your full document. The model never sees the answer, only helps write the query. This is text-to-query, not read-and-answer.

03Local AI sends nothing

QDev can run the natural-language → jq model fully on-device via WebLLM (WebGPU), Chrome's built-in model, or a local Ollama instance. In these modes nothing leaves your machine — not even the schema. Local AI is free and account-less.

04The hosted proxy

The hosted tier routes requests through a thin proxy to a hosted model. By design it is:

• Zero-retention. It does not log or store prompts or results. It validates your entitlement, forwards {schema, question}, and streams the answer back.
• Stateless.It keeps only what's needed to check your subscription and rate-limit abuse — ids and tokens, never your content.

05Account & billing

You only need an account for the hosted AI tier. Sign-in is handled by Clerk, and payments by Stripe (via Clerk Billing). Between them they hold your email and subscription status; QDev stores no payment details of its own.

When you connect the extension, it holds an opaque token — scoped to your entitlement and revocable at any time from your account. It is not a session key and grants no access to your data.

06Browser permissions

The extension requests only what it needs to read JSON in your tabs and, for the hosted tier, to reach the proxy and sign-in origins. It does not track your browsing, inject analytics into pages you visit, or read sites unrelated to viewing JSON.

07Source available

The viewer's source is available to read (under the PolyForm Noncommercial license), so none of the above is a promise you have to take on faith — you can read the code. The privacy model is the whole point of the product, not a footnote.