Your spreadsheet never reaches us.
Not “we delete it afterwards”. Not “we promise not to look”. Reading your file, cleaning it and building the file you download all happen on your own machine — so there is nothing on our side to leak, subpoena or sell.
Four lanes, and only one of them leaves your browser
AI never sees your workbook or all of its rows. TidyCell works the facts out locally and sends only a small, purpose-built receipt — and shows you exactly what left your browser, every time.
Every AI tool shows you the literal payload before it sends anything — the actual values, not a description of them — and nothing is sent until you press go. You can also turn AI off entirely and keep using everything else.
What never reaches our servers
- Your spreadsheet file
- Not a copy, not a temporary one. There is no upload step to opt out of.
- Your rows
- Including the rows behind every dashboard you build — those stay in your browser too.
- File names, sheet names, headers
- None of it is logged, and none of it reaches our usage analytics.
- Your formulas and formatting
- We edit the file you gave us instead of rebuilding it, so we never need to send them anywhere.
- Anything at all, if you skip the AI tools
- Every other tool is deterministic code running on your machine. Nothing leaves.
This isn't a policy we could quietly change — the app has no route that can accept your rows.
What we do store
- Your email address
- Only if you make an account. There is no password to steal — we don't have one.
- Your subscription state
- A mirror of what Stripe tells us: your plan, and whether it's active.
- Your file-unlock ledger
- A one-way fingerprint of an unlocked file, so an unlock survives a new laptop. The fingerprint can't be turned back into your file.
- Dashboard layouts
- Column names, their types, and which charts you picked. Never the rows behind them — those stay in your browser.
- Anonymous usage events
- A fixed list of button names and page paths. No file names, no cell values, no exact row counts, no IP address.
Deleting your account removes every one of these. The privacy policy spells out retention in full.
Hardened by default, not by request
- HTTPS everywhere
- With HSTS at a two-year max-age, covering every subdomain. Plain HTTP is never served.
- A strict Content-Security-Policy
- Scripts, styles, fonts and network calls are restricted to our own origin.
- Framing blocked outright
- frame-ancestors 'none' and X-Frame-Options: DENY, so the app can't be wrapped by a phishing page.
- No MIME sniffing, no referrer leakage
- X-Content-Type-Options: nosniff and a strict-origin referrer policy.
- Camera, microphone and location disabled
- Denied at the Permissions-Policy level. The app has no use for any of them.
Card details go directly to Stripe and never touch our servers. Sign-in is a one-time emailed link — we store no passwords, so there are none to breach.
Everyone we rely on, and what they see
This is the complete list. None of them receives your spreadsheet, because we don't have it to pass on.
- Vercel
- Hosting and CDN for the site itself.
- MongoDB Atlas
- The account records listed above. Never your spreadsheet.
- Stripe
- Payments. Card details go straight to Stripe — they never touch our servers.
- Resend
- Sends sign-in links and contact-form mail.
- ImprovMX
- Forwards mail sent to our address on to us.
- OpenAI
- Processes the bounded AI receipts described above — and only those.
Found something? Tell us.
Email hello@tidycell.com with what you found and how to reproduce it. We'll confirm we got it, and we'll tell you when it's fixed. There is no bug bounty — we're a one-person product — but we'll credit you here if you'd like.
Please don't run automated scans that degrade the service for other people, and please don't access data that isn't yours. Machine-readable contact details are at /.well-known/security.txt.
Last reviewed 30 July 2026
The best way to check is to watch it
Open your browser's network tab, drop a file, and clean it. You won't see it go anywhere.