Privacy Policy

Last updated: August 26, 2026

This policy describes what WebCSV ("we", "us") collects, why, and what your choices are. The short version: we collect what's needed to run a collaborative spreadsheet service and nothing more — no advertising, no analytics trackers, no selling of data.

What we collect

Account data — your name, email address, and a hashed password (we never store the password itself), plus whether your email is confirmed.
Session data — when you sign in we record a session with your IP address and browser user-agent string, used for keeping you signed in and for security.
Your sheets — the spreadsheet content you create or upload, its name, and edit timestamps. Sheets you create while signed in are linked to your account so we can show you your sheet list.
Presence data — while you have a sheet open, an ephemeral presence record (which cell is selected, and your display name if signed in) is broadcast to others viewing that sheet. It is never stored and disappears when you disconnect.
Contact form submissions — the name, email, and message you send us.
Emails we send you — transactional only: account confirmation and password reset. No marketing email.

What we don't collect

No analytics or advertising trackers, no third-party tracking cookies, no profiling. The only cookies we set are strictly necessary session cookies for signing in. We also use your browser's per-tab storage for an anonymous collaborator identity (a random name like "Crimson Otter") that never leaves your browser except as a presence label.

Who can see your sheets

Sheets are shared by link: anyone with a sheet's URL can view and edit it, including your display name in the collaborator list if you're signed in while editing. Don't put content in a sheet you wouldn't share with everyone who might receive the link.

Where your data lives

We use a small number of service providers to run WebCSV, each processing data only on our behalf:

Render (US) — application hosting and databases (account data, sessions, sheet content).
Cloudflare — DNS, email forwarding, and archival storage of inactive sheets.
Resend (US) — delivery of the transactional emails above.
Google Fonts — the app currently loads its fonts from Google's CDN, which means your IP address is sent to Google when pages load. We plan to self-host fonts to remove this.

Retention and deletion

Sheets owned by an account are kept until deleted; sheets not associated with an account are deleted after six months without views or edits. Inactive sheets move to archival storage and are restored when visited. Sessions expire automatically. Accounts and their data are kept until you ask us to delete them. To access, correct, export, or delete your data, use the contact form or email support@webcsv.com — we'll respond to all requests, including those under GDPR and similar laws (self-serve export and deletion are planned).

Children

The service is not directed at children and requires users to be at least 13 (16 where local law requires).

Changes

We'll post any changes to this policy here with an updated date. Material changes affecting how your data is handled will be called out.

Contact

Privacy questions or requests: contact form or support@webcsv.com.