Privacy Policy

What is collected

Your email address, and a Google or Microsoft identifier if you sign in that way. The workbooks you upload, the reports built from them, and the messages you write in the chat.

A cookie of our own, besides the ones that keep you signed in: a random value, set the first time this browser starts a free report and kept for a year, that tells this browser apart from others. It is used for one thing: the Free plan is one report a month per person, so when a free report starts we keep with it a fingerprint of that value and one of your email address (as your mailbox reads it, so a Gmail address with or without its dots or a "+" ending counts as one), each made with a key only our server holds, so neither can be turned back into what it was made from. They are compared with this month's other free reports to tell whether another account already used this month's free report. They are kept until the end of that month, after you delete your account too, then erased. Whether another account had already used it stays with the record that the report was started, which counts against the plan. The cookie is not used for analytics or advertising, and it is not sent anywhere but our own server.

When you enter a code for free reports, we keep a record that you entered it: your account, your own workspace, how many reports it gave and when they expire, and which reports were built with it. With it we keep a fingerprint of your email address, as your mailbox reads it, made with a key only our server holds, so one person cannot use the same code twice, through a second account or after deleting the first. The fingerprint is kept, after you delete your account too, until the code can no longer be entered, then erased; the record itself is kept, as the record of each report started is. A code that is refused is noted against your account, so that codes cannot be guessed: it is counted for an hour and erased by the next daily pass. Opening a code's link sets a second cookie of ours, which holds the code for an hour so that it is still there after you sign in, is sent only to the page that asks for it, and is deleted when the code is entered on its page or a code is added to your account, or after an hour. The fingerprint, the record and the cookie are not used for analytics or advertising: the analytics recorder is told only that a code was entered and how many reports it gave, never the code.

How it is used

To sign you in, to build your reports, and to show you what was built. Nothing is sold, and nothing is used to advertise to you.

Analytics

The site records which pages are opened and which buttons are pressed, through PostHog, so that we can see where people get stuck. It keeps no cookie for this: the recorder's id lives in your browser's local storage, and once you sign in it is tied to your account. Your email address is attached to that account record, so that when you write to us we can find what you saw without asking you to describe it. Your browser sends it to the recorder once you are signed in, and our server sends it with the events it records for your account. It is used for nothing else there: not to advertise to you, and not sold. The recorder holds no workbook content and no message text; of a note you write it keeps only the length. Of a file you attach it keeps only the type and the size (and, for a workbook refused as too large to build, how much data its sheets hold, in whole megabytes), and of each send how long each step took, in milliseconds. It also keeps which report styles you are shown and which one you build with, keep for new reports or restore an earlier version from, and whether a colour you chose had to be adjusted (never the colour itself). When something goes wrong it keeps the step it happened at and the error message the site showed you, without the name of your file. When a page cannot be drawn it also keeps the kind of failure from a short fixed list, never the error's own text; which page it was, with any ids and codes taken out of its address; which version of the site served it; whether the tab had been in the background; roughly how long the page had been open; and whether the page had already tried once by itself to load again. It keeps the address you arrived from so we can tell which channel brought you. PostHog also sees your IP address, from which it estimates your country and city.

Some things are recorded by our own server rather than by your browser, because they can happen after you have closed the page or would otherwise be hidden by a blocker: that a sign-in completed; that a build was accepted, finished or stopped, with the stage it stopped at and the reason; that a code for free reports was entered, with how many reports it gave; and, while you are signed in, the errors the site met, whether or not it showed you a sentence, with the step they happened at; and, with nobody signed in, that the sign-in screen itself failed, recorded under no account; and, when Google or Microsoft sends a sign-in back unfinished, which of the two it was and the error code it gave, never the message with it; and, when our server cannot finish a request, which page it was for, whether it was a page, an action, a route or the check every request passes through first, and the kind of error from a short fixed list, with our own name for the step that failed and never the error's message, recorded under no account with a code that matches it to the page's own report of the same failure. A content blocker stops everything your browser records, and the site works the same without it, but it cannot stop these.

AI models

Building a report calls an AI model, on OpenAI's API, at several steps: reading the columns, naming the subject, planning the report, and designing and titling its pages. The model is sent your column headers and sheet names as written (for a CSV file, its file name too); counts for each column, such as rows, distinct values and blanks; the lowest and highest value of every number column and the earliest and latest date of every date column; the shape of the first three entries in each column, with every letter replaced by a or A and every digit by 9, which keeps their length, punctuation and symbols; and the note and questions you give us. Each message you send in the chat is sent to it as well, with the titles of the report's visuals, which include the report's name and the latest date in the data. No other cell values and no rows are sent. If a sheet has no header row, its first row is read as the column headers and sent as them. Columns we recognise, mainly by their header, as email addresses, phone numbers, ID numbers, IP addresses or dates of birth are left out, except for their header names. Columns holding names or addresses are not left out, so remove any column that must not leave before you upload.

Where data lives

Accounts and metadata are stored with Supabase; report building runs on Render; the website runs on Vercel; usage is recorded with PostHog, which holds your account and the email address on it; emails from us, team invitations among them, are sent through Resend, which receives the addresses and the message it delivers, including the alerts we send ourselves when something goes wrong for you, which carry your email address and the error message the site showed you, and for a sign-in that did not finish the provider's error code; payments are taken by Paddle, the merchant of record, which holds your billing details and email address; building a report and each chat message call OpenAI's API, which is sent only what the section above describes. Each stores data only to provide the service. Workbooks and reports are isolated per account.

How long it is kept

A finished report is kept for 30 days after it is built, then deleted, and the stored workbook with it. Deleting a chat deletes its workbook and its compiled report at once. Deleting your account from Settings deletes every chat, workbook and report the same way, immediately.

The report builder also keeps a short record for each workspace: what it has learned from the changes you accept (such as the chart types and density you prefer), and the report style its owner keeps for new reports. A pinned style and its brand colours are stored until you unpin it or delete your account. Deleting your account deletes that record too, pin and all.

Your rights

You can download your reports, delete a report and its workbook at any time from the chat, and ask for your account to be deleted from the settings page.