Privacy policy
The sheets you design are built in your browser and are not uploaded. We store three things: anonymous usage events, emails people choose to send, and, only if you create one, a digital sign-in sheet and the entries visitors type into it.
Paper sheets and saved designs
Titles, column names, logos and contact details you type stay in your browser. Saved designs are kept in the browser’s local storage on your device. We never receive them.
Digital sign-in sheets: exactly what is stored
- The sheet: a random 128-bit id, its title, the optional “hosted by” name and its column names (up to 6), and the date it was created.
- The host key: only a one-way SHA-256 hash. The key itself is in your host link and nowhere on our side.
- Each entry: the answers a visitor typed (each at most 200 characters) and the time they signed in. We do not store the visitor’s IP address, name beyond what they type, or device details with the entry.
- Counters: how many entries the sheet holds and how many visitors were turned away after the 25-entry limit.
How long
Everything about a digital sheet is deleted automatically 90 days after the sheet was created. A daily cleanup job removes expired sheets, and a sheet that has expired can no longer be opened. The host can delete all entries, or the whole sheet and its links, at any time from the host page. Deleted data cannot be recovered.
Who can see entries
Anyone who has the host link. Keep it private. Visitors see only the sheet’s title, the host’s name if given, the column names and their own entry. Visitors see a short notice naming the host and the retention period before they sign in.
Who is responsible for the details
The host decides what to ask and what to do with the answers. We store the entries for the host and show them to the host. Do not ask for passwords, card numbers or other sensitive details.
Usage events and forms
- Usage events: a random visitor id stored in your browser, the page path, the referring site, campaign tags in the link, the country (from the network), a rough device type, and actions such as choosing a sheet type, downloading a PDF, printing, or opening pricing and checkout. Titles, column names and everything you type into a sheet are not sent. Pages under /in/ report only that path, never the sheet id.
- Forms: the email address and message you send through the contact form, or the email you enter at checkout.
- Network address: used only to limit how many requests one network can send per hour and per day, stored as a salted one-way hash in a counter.
- Spam protection: forms contain a hidden field that people never see and bots tend to fill in, and a form sent within a second or two of loading is ignored. There is no third-party spam check, no puzzle and no extra tracking. Messages caught this way are discarded and not stored.
What we do not do
- No advertising, no selling or sharing of data, no tracking cookies.
- Your email is used only to reply to you or to send the one message about checkout you asked for.
Third parties
- Cloudflare hosts the site and its database, and may measure page views in aggregate.
Your choices
To have your email or messages deleted, email support@signinsheet.site. Clearing your browser’s site data removes the random visitor id and any saved designs.