Privacy policy

1. The short version

Your spreadsheet never reaches us. Every tool on this site — the cleaner, the converters, the import checkers — runs inside your browser using JavaScript. The file is read from your disk into the browser tab, processed there, and written back out as a download. There is no upload step, so there is nothing on our side to store, read, leak, or hand over.

The only personal data we hold is an email address, and only if you typed one into a waitlist form.

2. Your files

We do not receive, store, log, or process the contents of any file you open with CSVTidy. That includes the personal data inside those files — the names, emails, phone numbers and addresses of your customers never leave your device.

You can verify this rather than take our word for it: open your browser's developer tools, switch to the Network tab, and clean a file. You will see no request carrying your data. Closing the tab discards everything.

3. What we store when you join a waitlist

Joining a waitlist is the only place CSVTidy collects personal data. When you submit the form we store one database row containing:

• Your email address, lowercased — so we can email you once when the feature launches.
• Which form you used and which feature you were asking about, so we know what to build and who to tell.
• Campaign parameters from the link you arrived on (utm tags), if any were present.
• Your browser's user-agent string, truncated to 512 characters, used to spot automated signup abuse.
• A salted one-way hash of your IP address, never the address itself, used for rate limiting. If our deployment has no hashing secret configured, we store nothing in this field rather than store a weakly-protected value.
• The date and time you submitted.

That is the complete list. It is one table, and those are all of its columns.

4. Cookies and browser storage

CSVTidy sets no cookies. There is no account system, no login, and no session to track.

We do use one item of local storage, under the key csvtidy-theme, which remembers whether you chose light or dark mode. It holds the word "light" or "dark", never an identifier, and it is not sent anywhere. Clearing your browser data removes it.

5. Analytics

Analytics are currently switched off. No analytics script loads and no third-party request is made from any page on this site.

If we turn analytics on we will use Plausible, which is cookie-free, does not track individuals across sites, and reports only aggregate page-level counts. We will update this section and the date at the top of this page when that happens.

6. Who else can see this

We do not sell personal information, and we do not share it for advertising. The waitlist data is handled by two processors: Vercel, which hosts the site and therefore handles the network request, and our Postgres database provider, which stores the row. Both operate under their standard confidentiality terms.

As with any web request, our host processes connection metadata including your IP address in order to route traffic and defend against attacks. That is a function of how the internet works rather than something CSVTidy collects.

7. Keeping and deleting data

Waitlist entries are kept until we have sent the launch email they were collected for, and then for a reasonable period afterwards while we act on the responses. We do not currently run automated deletion — entries are removed on request, and we will publish a fixed retention schedule here when one is implemented rather than describe a process we have not built.

To have your entry deleted, email hello@csvtidy.com from the address you signed up with, or naming it. No account or form is required.

8. Your rights

Whatever your jurisdiction, you can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted, by emailing hello@csvtidy.com. We aim to respond within 30 days. Since the only thing we hold is a waitlist email address, these requests are usually quick.

Specific statutory rights under regimes such as the GDPR, the UK GDPR, the CCPA and India's DPDP Act are not yet set out individually here. That section is being prepared with legal input and will be added before any paid subscription is offered. In the meantime the practical position is that we hold almost nothing, and we will delete what we do hold on request.

9. Children

CSVTidy is a tool for working with business data and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted an email address to a waitlist, contact us and we will remove it.

10. Changes

If we change what we collect, we will change this page in the same release and update the date at the top. Material changes to how waitlist data is used will be announced by email to the people on that list.

11. Contact

Questions, requests, or corrections: hello@csvtidy.com.