Privacy

Who is responsible

Terratra OÜ, registry code 16032976, Orumetsa tn 5/1-15, 74111 Maardu, Estonia, is the controller for the little personal data described here. Write to xliff@terratra.com about any of it.

What stays in your browser

The editor keeps what it needs in your browser's own storage, on your disk, where we cannot read it:

• your working session — the open file, your edits and your undo history — so a reload does not lose work;
• the edits of up to 30 files you worked on earlier, so they come back if you open the same file again;
• translation memories and the glossary you imported, so you do not have to import them again;
• a memory of the segments you confirmed in earlier files, so the next file gets matches from them (you can turn this off, or remove it, in the Memory panel);
• if you connected a project folder, a handle to it and progress figures for its files (their names and paths);
• AI keys you saved, unless you chose "This session only";
• the spelling dictionary of each target language you worked in, and the words you added to your own dictionary, per language (see below);
• a file you dropped on one of the site's pages (in Chrome and Edge, with your browser's reference to it on your disk, so Save can write back to it), only until the editor opens it;
• your settings (QA checks, keyboard layout, column order, whether the filter bar is open, AI prompts, autopropagation, whether Save downloads a copy) and which notices you dismissed;
• the QA issues you chose to ignore, for each file: which segment and which check (and, for a term, which term), not your text;
• a work log for each file: how many minutes you actively worked on it (counted only while the editor was in front and you typed, confirmed or moved between segments in the minute before), how many segments and words you confirmed, and when it was first and last counted. No text and no segment is in it. It is never written into the file you export, and it is in the analysis workbook only when you download one;
• a copy of the site's own files, so it opens offline.

All of it exists only to make the features you use work, which is why none of it needs your consent. "Start over" on the restore bar deletes the current session, the ignored QA issues and the work logs; Reset under Word count and analysis deletes one file's work log; clearing this site's data in your browser deletes everything listed here.

Saving into the file you opened

In Chrome and Edge on a computer, Save (Ctrl+S) writes your translation back into the file you opened, in its folder, instead of downloading a copy. Your browser asks you first, once for each file (for a file opened from a project folder, for the folder it is in). With that permission xliff.ai can write to that one file and, from a project folder, to one backup copy beside it, whose name ends in .orig before the extension, and only until you close or reload the tab. It writes nothing else on your disk, and the writing happens in your browser: no file, file name or content is sent anywhere.

Before every save the editor checks whether another program changed the file since you opened it, and asks you if one did. "Restore the original file" writes the file as you opened it back, while the tab is open. "Save as copy" downloads a copy instead, and "Always download a copy" under More (⋯) makes every save a download. In Firefox, Safari and on phones and tablets, Save downloads the translated file, as it always has.

Spelling, checked in your browser

The editor checks the spelling of your translation in your browser. The first time you open a file in a language xliff.ai has a dictionary for, your browser downloads that dictionary from xliff.ai itself, 0.5 to 5.3 MB depending on the language, and keeps it for the next file and for working offline. That download asks for a dictionary and nothing else: no text from your file, no file name and no word you looked up is sent with it, or anywhere. Checking, suggestions, "Ignore" and "Add to dictionary" all happen on your computer, and the words you add stay in this browser.

Like any request, the download passes through our web host (below), which can see which language's dictionary your browser fetched. You can switch spelling off under More (⋯) in the editor; your browser's own spell checker then takes over, as it does for a language xliff.ai has no dictionary for. The dictionaries come from the LibreOffice project, each under its own open-source licence, listed in the third-party licences.

AI translation on this computer

In desktop Chrome (version 138 or later) and Microsoft Edge, the AI panel can translate with the translator built into the browser. The translation runs on your computer: xliff.ai gives each segment's text to your browser's own translation model and sends nothing to anyone, so no text, no file name and no key leaves your computer. Google and Microsoft document that model as running on the device itself.

The first time you translate a language pair, your browser may download its translation model for that pair, from Google for Chrome or from Microsoft for Edge. That download is made by the browser itself and carries nothing from your file, but it does tell the browser's maker which language pair you asked for. The browser keeps the model for later, and xliff.ai stores nothing new for it.

AI review and translation, only if you use them

AI review, and AI translation with a provider, are optional and off until you add a key. If you use them, the API key you enter is kept in this browser and sent only to the provider you picked — Anthropic, OpenAI, Google, OpenRouter, DeepSeek, Azure OpenAI or an endpoint you name — together with the text the task needs: the source text of the segments in your current view (and their translations, for a review), two neighbouring segments on each side for context, and any matching glossary entries. The file itself, its name and your translation memories are not sent. That provider processes the text under its own terms and privacy policy. Terratra never receives your key or your text. "Clear all keys" removes stored keys, and "This session only" never writes a key to disk.

What the web host sees

Like any website, xliff.ai is delivered by a hosting provider, Cloudflare, which handles each request for a page and therefore sees your IP address, your browser's user agent and the address requested. It uses them to deliver the site and protect it from attacks, and keeps them only briefly in its logs. Your browser may also send Cloudflare technical reports when a page fails to load (network error logging), which carry the address and the kind of failure. None of these requests carry your files. Cloudflare acts as our processor; as a US company, it transfers data under the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. The legal basis is our legitimate interest in running a secure website (GDPR Article 6(1)(f)).

There are no analytics on this site. If that changes, it will be a cookieless, self-hosted counter that stores no personal data, and this page will say so before it goes live.

If you write to us

An email, or a bug report sent from the editor or the support page, reaches us with your email address and whatever you wrote. A bug report is built to describe the problem without any of your file's content, and you see the whole report before you send it. If you choose to attach a file to show us a problem, it reaches us like any email attachment. We use these messages only to answer you and fix the problem, and delete them when they are no longer needed for that. The legal basis is our legitimate interest in answering you and improving the tool (GDPR Article 6(1)(f)).

Links to other sites

The maker link goes to terratra.com, which has its own privacy policy; nothing about your use of xliff.ai is passed to it.

Your rights

You can ask us for a copy of any personal data we hold about you, to correct or delete it, to restrict how we use it, or to receive it in a portable form, by writing to xliff@terratra.com.

Your right to object. Where we rely on our legitimate interests — the host's logs and your correspondence with us — you can object at any time, on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds that override yours.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the data protection authority where you live.