Privacy

• CSV, TSV, TXT, and XLSX files are parsed in the browser.
• Crosstab tables, filters, weights, percentages, and statistics are computed from the parsed browser data.
• The original spreadsheet file is not uploaded for normal crosstab calculation.
• If you explicitly save a project, the parsed dataset and current settings are stored in this browser's IndexedDB when available, with localStorage used only as a compatibility fallback. Analysis templates use localStorage.
• New local-project links put the browser-only project identifier in the URL fragment after #. Browsers do not send fragments in HTTP requests, and Crosstabs responses use a no-referrer policy so the current page URL is not forwarded when you follow a link.
• A historical link that still uses ?project= has already exposed that identifier to the hosting edge for its first request. After the page loads, Crosstabs consumes that legacy value locally, removes it from the query and browser-history entry, and uses the fragment form for later navigation.
• A full .ctproj export is an explicit download containing respondent rows and the complete project graph. It is checksummed but not encrypted. A manifest-only export removes rows and specified data-derived fields but can retain authored labels, findings, comments, audit details, and branding.

• Creating a share link is an explicit action. The link places aggregate counts, row and column labels, and user-selected context in the URL fragment (the part after #).
• The source spreadsheet file and respondent-level rows stay in the creator's browser and are not included in the share link.
• The recipient's browser decodes the fragment. Browsers do not include URL fragments in HTTP requests or HTTP referrer headers, so Crosstabs does not receive or store the fragment through this feature.
• Anyone who obtains the complete link can read its aggregate values and context. Fragment encoding is not encryption or access control.
• These links have no expiration or revocation mechanism. Removing local browser data does not invalidate copies of a link that were already shared.

• Crosstabs does not run a hosted generative AI model or send browser projects to a model provider. Its hosted MCP performs deterministic project and analysis-plan operations, not a hosted model conversation.
• The separately installed local MCP runs in a user-controlled process. It does not upload respondent files or projects to Crosstabs; information shared with an AI client remains subject to that client and provider.
• The public statistical JSON API accepts bounded aggregate matrices. The hosted MCP is a separate service that also accepts consented file uploads and stores temporary projects.
• Browser-generated findings, warnings, and method disclosures come from the completed local table and remain available without a hosted AI request.

• Hosted MCP workspace data, queued job inputs, results, and artifacts are stored to carry out requested work. This operational storage is distinct from anonymous website analytics.
• Application logs should exclude workspace credentials, uploaded file contents, respondent values, and complete tool inputs or outputs. Service errors and operational status may still produce logs.
• Hosting providers may process request metadata and infrastructure logs under their own policies. Application-level exclusions are not a promise that no infrastructure metadata is collected.

• On production deployments, Crosstabs uses Vercel Web Analytics for redacted pageviews and coarse product-event occurrences, and Vercel Speed Insights for Web Vitals. Crosstabs does not create or send an account, user, session, or activation-attempt identifier.
• Before either analytics client sends a URL, query strings and fragments are removed. Aggregate snapshot routes under /s are excluded entirely, including after client-side navigation.
• Small sessionStorage records keep only the current tab's allowlisted activation surface, upload/sample/manual input, stage, coarse acquisition-provider category, and landing-cluster category. They stay in the browser, are not synchronized, and are not sent as a join key.
• Recognized UTM or referring origins are reduced to an allowlisted provider category before raw query values are discarded. Raw URLs, referrer paths, filenames, project identifiers, spreadsheet cells or rows, labels, filter values, AI text, and share fragments are not custom-event properties.
• Activation stages are reported only as separate aggregate event occurrences. Ratios between occurrence totals are directional diagnostics, not user, session, attempt, or conversion rates; Crosstabs has no joined analytics funnel.
• Other product-usage events use coarse buckets such as file type, file-size range, row-count range, variable-count range, result shape, and selected feature. They do not contain the original spreadsheet file or respondent-level values.
• Vercel Web Analytics derives a visitor hash from request data and rotates it after 24 hours under Vercel's current privacy design. Vercel may also process the redacted path, time, referring origin, approximate geography, browser, operating system, device category, and Web Vitals to produce aggregate reports. Provider processing and retention follow Vercel's current terms; Crosstabs stores no copy of these analytics events in an application database.

See Vercel's Web Analytics privacy documentation for current vendor details.

Saved projects, analysis templates, and report settings stay in this browser profile. Projects are versioned and stored in IndexedDB when available; older localStorage projects are migrated locally. They can be removed from the home page or workspace. Clearing site data in the browser also removes them. Tab-local analytics state is removed when that tab session ends or site data is cleared. Crosstabs does not silently delete an older project to enforce a fixed project count; a failed browser-quota write is reported instead. Export important projects before clearing data or changing profiles.

• The optional hosted MCP at https://mcp.crosstabs.com/mcp runs on Crosstabs servers. Unlike browser analysis and the local MCP, it receives uploaded respondent files, project state, job inputs, results, and generated exports.
• No account or API key is needed to connect. Creating a temporary workspace requires explicit consent to upload. Its secret workspace token is an access credential: anyone holding it can access that workspace. There is no account-based recovery.
• Workspace access expires 24 hours after creation. A worker cleans up expired active data; infrastructure backups follow separate provider retention. Expiry is not a promise that every backup copy is erased within 24 hours. Export needed work before expiry, or delete the workspace earlier.
• Only upload data you are authorized to send to this hosted service. Your chosen AI client or provider has its own policies for tool inputs and results; local computation does not make an AI conversation local.