Privacy Policy

SheetMatters (sheetmatters.com) is operated by CODECAMPUS LLC, 1839 Lake Saint Louis Blvd, Lake Saint Louis, MO 63367, United States, and that company is the controller of the data described here. The list below is short on purpose: a spreadsheet shop needs an email address, a record of what you bought, and very little else. We run no advertising, we build no profiles, and we have never sold anybody’s data.

Stripe processes every payment. Your card number, its expiry and its security code travel from your browser straight to Stripe, and are never seen, handled or stored by SheetMatters. What comes back to us is a customer id, the status of your orders and, if you subscribe, whether the subscription is live and when it next renews. Stripe handles that data under its own privacy policy.

• Your email address, together with the Stripe customer id created for you the first time you check out.
• A one way hash of your password, once you have set one. The password itself is never stored and never logged, and it cannot be read back out of the hash by anyone, ourselves included. That is why a forgotten password gets replaced rather than looked up.
• Which sheets you own, and which version of each one you hold.
• Your orders, meaning the sheet or collection, the amount, the currency and the status, plus VIP status and renewal date for members.

Buying needs no account. Check out as a guest and we create one from the email address you gave Stripe, so you can sign back in later and copy again anything you own. You choose the password on it yourself, using a single use link we send to that address. If you mistype the address at checkout the sheet still reaches you straight away, but the account belongs to whatever you typed. Write to [email protected] and we will move it.

Sending us a message stores the name, email address and message you typed, plus one derived value that stands in for your IP address:

• A salted, one way SHA-256 hash of the IP address the request came from. The address itself is never written to our database or our logs, and the hash cannot be turned back into it.
• That hash lets us recognise a repeat sender. Five messages an hour from the same one and the form stops accepting more.
• It is erased 30 days after the message that produced it. Your message stays until we have dealt with it, and the hash beside it goes.

The form is also protected by Cloudflare Turnstile, which is the part that actually stops bots. Turnstile receives your IP address directly and processes it under Cloudflare’s own privacy terms.

The only cookies SheetMatters sets are the session cookies that keep you signed in. They are what lets the site recognise you and hand over a sheet you own. There are no advertising cookies, no analytics trackers and nothing that follows you to another site.

Downloading a sheet means being sent to Google’s "make a copy" page, which puts a copy in your own Google Drive. That copy is yours, inside your Google account. SheetMatters has no access to your Drive and cannot read, change or delete anything you keep there, the sheet included.

Account and purchase records live in a database on our own server infrastructure in the United States. Our providers and their infrastructure are US based, so that is where your data is processed.

Beyond that, the list of who touches it is simply the list of what makes the shop work. Stripe for payments. Cloudflare for the anti-spam check on the contact form. Resend, which delivers the set a password email and therefore handles your address and the link inside it. Google, which hosts the sheet templates and the Drive you copy them into. The database itself is ours and no third party runs it. Otherwise we disclose data only where the law compels us to.

Account and order records are kept while you have an account, which is what lets you download a sheet again years later, and afterwards for as long as legal, tax and accounting obligations require.

Contact form hashes are erased after 30 days, automatically, as described above.

Write to [email protected] from the address on your account to see, correct or delete what we hold. Deleting the account ends your ability to sign in and download again. It has no effect on a sheet already copied into your Google Drive, which stays yours regardless. Where a record has to be kept for tax or accounting, we keep that record and delete the rest.

If what we collect changes, this page changes with it and the effective date at the top moves. Material changes go up here before they take effect.

Anything about your data, answered by a human:

Or by post: CODECAMPUS LLC, 1839 Lake Saint Louis Blvd, Lake Saint Louis, MO 63367, United States.