Privacy

• CSV, TSV, TXT, and XLSX files are parsed in the browser.
• Crosstab tables, filters, weights, percentages, and statistics are computed from the parsed browser data.
• The original spreadsheet file is not uploaded for normal crosstab calculation.
• If you explicitly save a project, the parsed dataset and current settings are stored in this browser's IndexedDB when available, with localStorage used only as a compatibility fallback. Analysis templates use localStorage.
• New local-project links put the browser-only project identifier in the URL fragment after #. Browsers do not send fragments in HTTP requests, and Crosstabs responses use a no-referrer policy so the current page URL is not forwarded when you follow a link.
• A historical link that still uses ?project= has already exposed that identifier to the hosting edge for its first request. After the page loads, Crosstabs consumes that legacy value locally, removes it from the query and browser-history entry, and uses the fragment form for later navigation.
• A full .ctproj export is an explicit download containing respondent rows and the complete project graph. It is checksummed but not encrypted. A manifest-only export removes rows and specified data-derived fields but can retain authored labels, findings, comments, audit details, and branding.

• Creating a share link is an explicit action. The link places aggregate counts, row and column labels, and user-selected context in the URL fragment (the part after #).
• The source spreadsheet file and respondent-level rows stay in the creator's browser and are not included in the share link.
• The recipient's browser decodes the fragment. Browsers do not include URL fragments in HTTP requests or HTTP referrer headers, so Crosstabs does not receive or store the fragment through this feature.
• Anyone who obtains the complete link can read its aggregate values and context. Fragment encoding is not encryption or access control.
• These links have no expiration or revocation mechanism. Removing local browser data does not invalidate copies of a link that were already shared.

• Crosstabs does not provide a hosted model, prompt, project-planning, or open-end-generation service. It does not send browser projects or respondent data to an AI provider.
• An AI or local agent can use the separately installed local MCP package inside a user-run process. Files, rows, and project state stay within that local environment.
• The public API and remote MCP accept only explicitly supplied aggregate matrices, bounded display labels, or public evidence queries. They perform deterministic calculations and evidence lookup without retaining a project or opening a model conversation.
• Browser-generated findings, warnings, and method disclosures come from the completed local table and remain available without a hosted AI request.

• The public remote MCP accepts methodology identifiers, search text, optional display labels, and aggregate contingency matrices. It has no respondent-file or raw-row upload tool.
• Every remote MCP response receives a server-generated correlation identifier and an aggregate request-duration metric for production diagnosis.
• Structured runtime events contain only the HTTP method, a fixed allowlisted MCP method name, anonymous-or-bearer mode, allowed/rejected/absent browser-origin state, response status, and duration.
• Authorization values, tool arguments, search text, labels, matrices, project data, response content, and respondent values are not written to the application log event.

• On production deployments, Crosstabs uses Vercel Web Analytics for redacted pageviews and coarse product-event occurrences, and Vercel Speed Insights for Web Vitals. Crosstabs does not create or send an account, user, session, or activation-attempt identifier.
• Before either analytics client sends a URL, query strings and fragments are removed. Aggregate snapshot routes under /s are excluded entirely, including after client-side navigation.
• Small sessionStorage records keep only the current tab's allowlisted activation surface, upload/sample/manual input, stage, coarse acquisition-provider category, and landing-cluster category. They stay in the browser, are not synchronized, and are not sent as a join key.
• Recognized UTM or referring origins are reduced to an allowlisted provider category before raw query values are discarded. Raw URLs, referrer paths, filenames, project identifiers, spreadsheet cells or rows, labels, filter values, AI text, and share fragments are not custom-event properties.
• Activation stages are reported only as separate aggregate event occurrences. Ratios between occurrence totals are directional diagnostics, not user, session, attempt, or conversion rates; Crosstabs has no joined analytics funnel.
• Other product-usage events use coarse buckets such as file type, file-size range, row-count range, variable-count range, result shape, and selected feature. They do not contain the original spreadsheet file or respondent-level values.
• Vercel Web Analytics derives a visitor hash from request data and rotates it after 24 hours under Vercel's current privacy design. Vercel may also process the redacted path, time, referring origin, approximate geography, browser, operating system, device category, and Web Vitals to produce aggregate reports. Provider processing and retention follow Vercel's current terms; Crosstabs stores no copy of these analytics events in an application database.

See Vercel's Web Analytics privacy documentation for current vendor details.

Saved projects, analysis templates, and report settings stay in this browser profile. Projects are versioned and stored in IndexedDB when available; older localStorage projects are migrated locally. They can be removed from the home page or workspace. Clearing site data in the browser also removes them. Tab-local analytics state is removed when that tab session ends or site data is cleared. Crosstabs does not silently delete an older project to enforce a fixed project count; a failed browser-quota write is reported instead. Export important projects before clearing data or changing profiles.