Your spreadsheet never leaves your computer.

For your security team

Why the data can’t leave — by construction

Client-side compute

All parsing and every transform run in-browser on a WebAssembly engine. No cell value is serialized into any request to our servers — the compute never touches a backend.

A browser-enforced egress ceiling

A Content-Security-Policy connect-src allowlist caps where the page may make network connections: our own origin, and Stripe — our payment processor — for checkout. It is enforced by the browser, not by our code, and it does not include any AI, model, analytics, or third-party storage host. You can read the header yourself.

Nothing persists

Your data lives only in the tab’s memory. Reload and it is gone — no server row, no local database, no cached copy of the file’s contents.

The honest boundary

To be precise — the app does talk to our servers, for exactly three kinds of call. Signing in and out: sending your link, redeeming it, and checking whether you are still signed in — that last check runs on every page load, including this one. Your subscription: checking it, including a fresh check each time you download a file, and starting a Stripe checkout or billing-portal session when you click Subscribe or Manage billing. Your saved recipes: listing them, saving, renaming, deleting, and noting when one was last used. A recipe is the steps you chose, the column names they act on, and the settings you typed into each step — a formula, a category label, a date format. What it leaves out on purpose is the value you filter on: our server will not accept it, so a recipe cannot hold the “Texas” or the 5000 you were looking for — you pick that again each time you re-run it. And what never rides along is your data: not one row, not one cell of the file you loaded. The one other host the browser may connect to is Stripe, and only for payment. That is the whole list, and it is what the proof below lets you check.

Prove it

Watch your file stay put

Pick a CSV or text file (.csv, .tsv, .txt). It is read right here in this tab, and every request this page’s JavaScript makes via fetch or XMLHttpRequest is listed below as it happens. Your browser’s Network tab will show more than this table — images, fonts, the analysis runtime — because it also counts loads this log cannot see.

To be exact about this page: it loads the app shell and fonts, and the header asks GET /auth/me whether you are signed in. That session check usually runs before this monitor starts watching, so expect it in your Network tab and not in the table above. The subscription check happens in the app itself, not here. What never appears in any of them is your file’s contents. That is the claim, and this is the evidence.