Privacy

Files you open

Files you drop on a page are read by your browser and never uploaded. Remote URLs are fetched by your browser too. When a host blocks that, our proxy fetches the file for you and passes it through without keeping a copy.

Files you push

Pushed files and their versions are stored in Cloudflare R2 in the EU. Dataset details like title, summary, findings, column names and provenance are stored in our database. We store hashes of dataset tokens and API keys, never the tokens or keys themselves.

Public datasets can be opened by anyone with the link. Private datasets only by their owner. Dataset pages are marked noindex, so search engines don't list them.

How long we keep it

Anonymous datasets are deleted 7 days after creation unless someone keeps them. Kept datasets stay until you delete them. Older versions are removed once they pass your plan's retention period. When a dataset is deleted, its files are removed from storage within the hour.

Your account

Sign-in uses Firebase Authentication by Google. We receive your email address and a user id, and store your plan and datasets against it. Payments run through Stripe via our payments service. We see your plan and subscription status, never your card details.

Analytics and logs

We use Simple Analytics and our own self-hosted analytics, both without tracking cookies. The product records events like pushes, page views and exports to see what works. Events are kept for 180 days.

To enforce anonymous limits we store a salted hash of your IP address, never the address itself. Daily usage counters are deleted after 14 days.

In your browser

We set no cookies of our own. Your browser's local storage holds the theme you picked, the dataset tokens of links you own, and Firebase's sign-in state.

Your rights and contact

You can delete your datasets and API keys any time from your account. To get a copy of your data, delete your account, or report a dataset, email abuse@bitgate.com.