Privacy and Security

Privacy & Security

The short version

Your data never leaves your device. Blinkql has no backend, no database and no accounts. The website is a set of static files; once it's loaded, all analysis happens inside your browser tab.

Where your data goes

Data	Where it goes
Local files you open	Read directly by your browser into the in-browser engine. Never sent over the network.
Remote files (by URL)	Fetched by your browser straight from the host you entered. Blinkql has no servers in the path.
Saved queries, history, settings	Stored locally in your browser (IndexedDB). Clearing site data removes them.
Imported files	A copy is kept in your browser's Origin Private File System, accessible only to Blinkql in your browser profile, so the tables come back after a reload. Forget on a table deletes its copy; clearing site data removes them all. Remote files are not copied.
Shareable links (planned)	Contain SQL text and chart settings only, never data. ⚠️ If your SQL contains literal values (for example WHERE employee_id = 'E1042'), those values are part of the link.

Network activity you might see

• Loading the app: HTML, JavaScript, CSS and the DuckDB WebAssembly engine, served from Blinkql's static host.
• Remote queries: requests to URLs you entered.
• Engine extensions: some DuckDB features, including the Parquet and JSON readers, are extensions that load the first time they're used. Blinkql serves them from its own origin, pinned to one version and checked against published checksums when the app is built; your browser never contacts DuckDB's extension repository. This downloads code to your browser; nothing is uploaded.
• Analytics: Blinkql collects no telemetry about your files, queries or results. If anonymous page-view analytics are ever added, they will be cookieless and aggregate-only, and will be documented on this page first.

You can verify all of this in your browser's DevTools, under the Network tab.

Security measures

• Content Security Policy restricting scripts to Blinkql's own origin, plus 'wasm-unsafe-eval', which browsers require to run WebAssembly
• Cross-origin isolation (COOP/COEP) headers
• Self-hosted, version-pinned engine assets and extensions, checksum-verified at build time, with no third-party CDN or extension repository at runtime
• Lockfile-pinned dependencies with automated vulnerability alerts (Dependabot)
• Sandboxed execution: SQL runs inside your own browser and can only access data you loaded or URLs you provided

Reporting a vulnerability

Please don't open a public issue for security problems. Report them privately through GitHub's private vulnerability reporting on the repository's Security tab. Reports are acknowledged as quickly as possible, and reporters are credited in the fix's release notes unless they prefer otherwise.