Privacy Policy

Last updated: September 26, 2026

Schema.biz is operated by Horizon Two Labs ("we"). This policy explains what happens to data when you use the site. Questions go to hello@schema.biz.

In short

• The tools run in your browser. What you type or paste into them is processed on your device and isn't sent to us.
• When you check a page by its URL, the address goes to our server, which fetches the page and sends it back to your browser to be checked. The page is kept only in a 10-minute cache.
• When you use a tool, we record what kind of check it was: the tool, the schema types and error codes it found, counts, and the address of the page being checked, without its query string. Never the markup, code or other input you enter. This is always on.
• Google Analytics measures every visit, from the first page load. You choose whether it may use cookies. Either way, it keeps measuring.
• Cloudflare hosts the site and runs Cloudflare Web Analytics, which doesn't use cookies.
• Pages load their fonts from Google Fonts.
• There are no accounts and no ads, and we don't sell data.

What you enter into the tools

The tools (generators, validators, the database and API tools) run as JavaScript in your browser. Your markup, SQL, schemas, specs and form values are processed on your device. They aren't sent to Schema.biz, and our analytics never include them. What we do record about each check is listed under Tool usage metrics.

They leave your device only when you choose to send them:

• "Test in Google" buttons (JSON-LD Generator, Schema Validator) copy your markup to the clipboard and open Google's Rich Results Test in a new tab. Google receives the markup only if you paste it there. For a page checked by its URL, "Test in Google" and "Also open in Google Rich Results Test" open the Rich Results Test with that page's address instead, and we record the address without its query string (see Tool usage metrics). Google's privacy policy applies there.
• "Check a URL" (Schema Validator, Schema Audit, AI Search Optimizer) sends the address you enter to our server; see Checking a URL.
• Share links (Schema Validator, JSON Schema Validator, and the JSON-LD Generator's Share button) put your input into the link, after the #. The two validators keep that link in the address bar as you work; the Generator makes one only when you click Share. Browsers don't send the part after the # to the server, and our analytics record page addresses without it. Anyone you give the link to can read the input, and the link stays in your browser history.

Checking a URL

The Schema Validator, Schema Audit and AI Search Optimizer can check a page by its address. When you check a URL, or open a link to one of these tools with ?url= and an address in it:

• Your browser sends the address, in full, to our server at schema.biz. The request carries no cookies and doesn't include the address of the Schema.biz page you're on.
• Our server fetches that page from the internet as SchemaBizBot and sends its HTML back to your browser, where it's checked like pasted code. The page's own server sees a request from SchemaBizBot on Cloudflare's network, not from you.
• We don't log the page or keep it, except in Cloudflare's cache for up to 10 minutes, so repeat checks of the same address are quick. Anyone who checks that address in that time gets the cached copy.
• We record the address that was checked, with its query string removed, and what the check found, as described under Tool usage metrics.
• To limit how many pages one visitor can have fetched, our server uses your IP address for about a minute, in memory only, and Cloudflare can block visitors who send too many checks. Neither stores it with the check.
• A ?url= link holds the address it checks, so it stays in your browser history and anyone you give it to can see it. Google Analytics is told the page's address without it.

Tool usage metrics

To learn which tools and checks are useful, each tool records what kind of check it ran. When a tool runs, or you use one of its buttons (copy, download, share, "Test in Google"), the page sends a short record to our server at schema.biz, which stores it in a database we run on Cloudflare (Cloudflare D1). A record holds:

• the tool, the action and what started it: a button, typing, a sample, a share link or a URL check;
• for the markup tools: the schema.org types found, the formats (JSON-LD, Microdata, RDFa), issue codes such as REQ_MISSING, the numbers of errors, warnings and notices, which Google search features the markup qualifies for or is missing requirements for, and the AI Search Optimizer's score;
• for a URL check: whether the page could be fetched, and if not, why (an address we don't fetch, a page that isn't HTML, no answer, too many checks, or an error status such as 403); the page's HTTP status, how long the fetch took, how many redirects it followed and the page's size; whether it came from the 10-minute cache; and whether the check was opened from a link. Never the page's content;
• for the JSON-LD Generator: the schema type and template, how many fields are filled, whether the markup is valid, and whether it has a URL, sameAs links or an image, never the values;
• for the other tools: settings and counts, such as the SQL dialect, the number of tables, the JSON Schema draft or the OpenAPI version, and for an OpenAPI spec only the kind of host its servers use (public, localhost, private or example), never the addresses;
• the address of the page the checked markup is about, when it names one (its canonical link, its og:url, or the url or @id in the markup), or, for a URL check, the address of the page that was fetched (after any redirects). The query string, anything after # and path parameters such as ;jsessionid=… are removed before the record leaves your browser. For addresses on localhost, private networks or example domains, we keep only that kind of address, not the address;
• the size of the input, whether it's one of the built-in samples, and a one-way fingerprint of it (the first 16 characters of its SHA-256 hash), so repeat checks of the same input can be counted. The fingerprint can't be turned back into the input; it only shows whether two checks were of exactly the same text;
• for the Type Explorer's search, only how long the search was and how many types it found;
• the Schema.biz page you were on, the name of the site that linked you here (such as www.google.com), your country (from Cloudflare), whether you're on a phone or a computer (worked out from your browser's user agent, which isn't stored), a random ID for your visit that exists only in the page's memory, and the version of the site.

A record never includes what you typed or pasted (markup, SQL, schemas, specs, form values or search terms), table or column names, your IP address, your full user agent, cookies, or any identifier that lasts beyond your visit. The request carries no cookies.

Like the rest of our analytics, it's on for every visit, whatever you choose in the cookie notice; it uses no cookies. If your browser sends a Global Privacy Control signal, records leave out the address of the page being checked. Records are deleted after 13 months. Google Analytics gets a shorter version of each record: the tool, the result and the main schema type, with counts; never the page address being checked.

Google Analytics and cookies

We use Google Analytics 4 (GA4), a Google service, to measure how the site and its tools are used. It runs on every page and measures every visit from the first page load: before you answer the cookie notice, and whatever you choose.

GA4 receives the address of each page you view (without the part after #, and without the address in a ?url= link to a checker), the page that sent you here, your browser and device type, screen size and language, and your approximate location, which Google works out from your IP address. It also receives events about how the tools are used, such as "validated a schema" with the main schema type and the number of errors found, or which export format was picked. These events never include what you entered or the address of the page being checked.

Your cookie choice

GA4 can store two cookies, _ga and _ga_CY7CJLL4Z3, to recognize returning visits. They last up to 2 years. The cookie notice lets you choose whether GA4 may use them:

• OK: GA4 may use its cookies.
• No cookies: GA4 measures without cookies, and we delete the GA cookies already set. This does not turn Google Analytics off. Your visits are still measured, but GA4 can't recognize you when you come back.

Until you choose:

• In the European Economic Area, the UK and Switzerland, GA4 measures without cookies.
• Everywhere else, GA4 uses cookies.

You can change your choice at any time with Cookie settings at the bottom of every page, or here: Cookie settings. Your choice is saved in your browser, so the notice doesn't come back on every page.

Advertising features are off

The site shows no ads. We tell Google Analytics that advertising storage, advertising user data and ad personalization are all denied, using Google's Consent Mode.

How long Google keeps the data

GA4 keeps event-level data for the retention period set in our Google Analytics property (Google offers 2 or 14 months) and keeps aggregated reports after that. Google processes the data under its own terms: see how Google uses information from sites that use its services and the Google Privacy Policy. Google also offers a browser add-on that blocks Google Analytics on every site.

Cloudflare

Cloudflare hosts and delivers the site. To serve pages and protect the site from attacks, it processes your IP address and the details of each request, such as the page requested and your browser. See Cloudflare's privacy policy.

We also use Cloudflare Web Analytics on every page. It counts page views and measures how fast pages load. It doesn't use cookies or other storage in your browser.

Google Fonts

Pages currently load their fonts (Inter and JetBrains Mono) from Google Fonts. Your browser downloads them from Google's servers, so Google receives your IP address and standard request details such as your browser type.

Data stored in your browser

Local storage stays on your device and is never sent to a server. You can delete all of it in your browser's site data settings.

What we don't do

• We don't have user accounts or ask for personal details.
• We don't show ads or use advertising cookies.
• We don't sell data or share it for advertising.
• We don't use session recording or heatmaps.

Email

If you email us, we keep the conversation so we can reply and follow up. We don't add your address to mailing lists or share it.

Your rights

Depending on where you live, you may have the right to access, correct or delete personal data about you, and to object to how it's processed. Email hello@schema.biz and we'll help as far as we can. We don't hold analytics data under your name: GA4 links visits to a random cookie ID, or to nothing when cookies are off, and our tool usage records hold no IP address, cookie or lasting ID. You can also contact your local data protection authority.

Where data is processed

Google and Cloudflare operate worldwide, so the data described above may be processed in the United States and other countries.

Children

Schema.biz is a site for developers and isn't directed at children.

Changes to this policy

When we change how the site handles data, we update this page and the date at the top.

Contact

Horizon Two Labs, hello@schema.biz.