Uploading a bunch of stack traces to generate a flame map is one thing, but the heap can have secrets and keys and so on in memory.
https://heaphero.io/heap-terms.jsp: >Software applications generate a specialized type of log file. These log files are hard for engineers to interpret and troubleshoot. Using the Site, users can upload log files and we parse, analyze, and generate root cause analysis reports instantly.
>By uploading log files or leaving us feedback, you may provide text, images, software, videos and/or other material, including third party content ("User Content") that you share using the Site.
>Your User Content belongs to you (or to the relevant third parties). However, you grant the Company the following non-exclusive license: a worldwide, transferable and sub-licensable right to use, copy, modify, distribute, publish, and process, information and your User Content that you provide through the Site, without any further consent, notice and/or compensation to you or others. You also grant us the right to use your log files to enhance the performance of our Services.
Not that I would trust even a perfect privacy policy when it comes to uploading heapdumps.
There are however some websites that work completely offline (you download the HTML page and there is no network IO), like CyberChef [1] or the Spotify thread dump analyzer [2].
And for heap dumps, just use Eclipse MAT [3].
[1] https://gchq.github.io/CyberChef/ (yes, that GCHQ)
In my eyes, anyone using such a service is as careless as someone posting unencrypted lists of his passwords hidden in Lorem Ipsum texts on Facebook so he can look them up if he forgets one. Any sane corporate data protection rulebook should prohibit the use of such services and consider any potential surreptitious use a harsh breach of trust and thus a cause for termination of the employment.
Definitely do not use their cloud service to analyze heap dumps out of production. You will probably be leaking sensitive company secrets, and, if your company's data handling policies are at all reasonable, you'll probably also be violating legal obligations to your clients, as well as their trust.
Doing it for development may be safer, insofar as it it's more likely to merely be dangerous, but not also tortious or unethical.
Ever wondered when the most recent leak of your most valuable secrets occurred? Simply upload your password file to my web service and within moments the magic of our distributed AI will return the current date/time...
Doesn't cynically take passwords, but could in theory harvest emails.
Still, even offering the public upload option is a serious concern. They'd be better suited offering a download with free tier limitations.