Privacy Policy

• All Excel and CSV file processing occurs locally in your browser using JavaScript
• No spreadsheet files or spreadsheet contents are uploaded to our servers or third-party services
• Files are read directly from your device using the FileReader API
• Processing uses client-side libraries (XLSX.js and PapaParse) without external connections
• Data exists only in your browser's memory during the active session
• Closing the browser tab immediately clears all spreadsheet processing data from memory

• We do not store any of your spreadsheet files or processed data
• Account information: your email address and account creation time
• Login verification code records: email, a hash of the code (plaintext is never stored), the requester's IP address (used for rate limiting and abuse prevention), a 10-minute expiry, and attempt count
• Session records: a hash of the session token (the token itself is not stored), plus creation, last-active, and expiry timestamps (about 90 days)
• Entitlement records: email, purchased plan, status, expiry date, and the payment platform's order or subscription reference
• Payment order records: order number, purchasing email, plan, amount, payment channel (WeChat Pay or Alipay), and the channel's transaction number
• Payment webhook processing records, used to ensure each order is processed only once
• The data above is stored in Supabase and never includes any spreadsheet files or their contents
• Browser localStorage only caches your entitlement information (plan and expiry date, refreshed automatically within about 24 hours) and never stores spreadsheet contents
• Your login session is maintained through an HttpOnly cookie (valid for about 90 days), and a separate cookie records your language preference
• Temporary browser memory is automatically cleared when you close the tab
• Generated test data is created dynamically and not stored

• Server APIs handle only authentication (login codes and sessions) and payment-related data, and never receive spreadsheet contents
• HTTPS encryption protects your connection to our website
• Spreadsheet files are processed only in the browser and are never uploaded
• Login verification codes and session tokens are stored only as hashes, never in plaintext; card and other payment details are handled by the payment providers and never reach us
• Regular security updates for all dependencies

• Right to Access: All spreadsheet processing happens on your device - you have full control
• Right to Logout: You can sign out at any time, which immediately clears the local session information in your browser
• Right to Deletion: Close the browser tab to clear local spreadsheet processing data; to delete your account and its associated data, request it through the support email below
• Right to Portability: Download your processed files in Excel or CSV format
• Right to Information: This policy provides complete transparency about our practices
• Right to Complaint: Contact us with any privacy concerns

• Cloudflare Workers and Email Service: Host the website and the authentication and payment APIs, and deliver login verification and purchase confirmation emails, without receiving spreadsheet contents
• Supabase: Stores the account, entitlement, order, and session data described above, never including spreadsheet contents
• WeChat Pay and Alipay: Process RMB QR-code payments
• No third-party service can access your spreadsheet contents
• Third-party JavaScript libraries (XLSX.js, PapaParse) run locally in your browser
• We do not share, sell, or transfer your spreadsheet contents to third parties
• Links to external websites are clearly marked and governed by their own privacy policies

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the 'Last Updated' date. Continued use of the service after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us at: