Who this notice covers
Chartlapse is a client-first visual storytelling tool. This notice describes product behavior for the public web app and Creator. It is not legal advice and may be revised before or after a public launch.
Embedded AI research, remote planning and AI repair are paused for this beta. Copying Excel instructions makes no AI request. If you use your own AI, its terms govern what you share with it. Custom icon URLs are loaded by your browser from the image host; the remote-AI details below describe retained, paused capabilities.
AI table conversion for “Upload your own file — as it is” is a separate path that sends your table’s content to our AI provider only after you choose Send to AI; it is described in its own section below. Pasting or uploading a ready table and the blank template path stay in your browser.
Notice version 2026-10-08 (draft-public-v1).
Your Excel files stay local by default
When you choose a .xlsx file in the Creator, Chartlapse reads it in your browser. The raw workbook bytes and table rows are not uploaded to Chartlapse servers for ordinary planning or preview. The one exception is AI table conversion, which you start yourself and which sends table content (not the file) as described below.
File name and a content hash may appear in a Project Document you create so the result can be audited later. That metadata is part of the document you control—not a server-side workbook store.
- D1 · Original Excel bytes — browser memory only unless you keep your own file
- D2 · Parsed rows and mappings — browser memory only during the session; AI table conversion sends table content only after you choose Send to AI
- Cloud saving stores the validated Project Document, never the original workbook bytes
Project Documents are the unit of save and share
A Project Document is the validated JSON description of your visualization (items, times, values, renderer settings, presentation text, and audit notes). It is the default unit for download, reopen, and sharing.
Downloading JSON stores a file on your device. If you explicitly create a share link, Chartlapse stores that validated Project Document—not the original workbook bytes—in its Cloudflare database for up to 30 days. Share links remain separate from account cloud projects.
After signing in, Save to cloud stores the current Project Document against your site-specific account id. It includes the chart’s normalized data and settings so editing can continue on another device. The first save is explicit; edits to that cloud project then autosave with revision conflict protection.
- Share links expire 30 days after creation
- Expired documents and their report rows are deleted on access or by bounded background cleanup
- Cloud projects remain until you delete one or choose Delete all cloud projects; current safety limits are 50 projects per account and 900KB per Project Document
- Manual early-delete for anonymous share links is not available yet
Connected data, live embeds, and server-generated videos
Live data is optional. After you select a saved chart, map its columns, and confirm server access, Chartlapse fetches the chosen public CSV or Google Sheet and stores its latest validated chart data, mapping, source URL and update status. A webhook accepts CSV only with your private connection key or a valid signed delivery. Invalid updates preserve the last successful chart.
Connecting private Google Sheets is separate from signing in. Google asks for read-only Sheets access; Chartlapse reads the sheet URL you configure and encrypts the stored refresh token. The token is not included in charts or shared links. Disconnect Google Sheets deletes this token, attempts to revoke Google's authorization, and pauses those automatic updates. Existing saved charts and published snapshots remain until you delete or unpublish them.
Generate MP4 requires your consent to process a saved chart on Chartlapse's servers and operated rendering worker. Automatic videos require the corresponding option when connecting live data. The worker temporarily processes the chart document, removes its local working files after rendering, and stores the resulting MP4 privately in Cloudflare object storage. Unsaved edits and local audio are not included. Video jobs and downloads expire 30 days after the request; expired files are removed by background cleanup, which may be delayed while the worker is unavailable.
Publishing a live chart requires a separate confirmation that future updates may also be public, including data from a private Sheet. Its read-only link and website embed show the published chart data for up to 30 days. Unpublish revokes that live link; disconnecting the data source or deleting its underlying saved chart removes its live publication, snapshots and video jobs. File deletion is retried through a durable cleanup queue if object storage is unavailable. Other downloaded copies and third-party website caches are outside Chartlapse's control.
Optional account sign-in
You can use Creator without signing in. Chartlapse may use the Sites-managed ChatGPT sign-in fallback or offer direct Google and passwordless email-code sign-in. Direct methods are brokered by Supabase; Google handles its own credentials, and Chartlapse never receives your Google or email password.
For direct sign-in, Supabase processes the provider identity, email when supplied, profile claims, and the authentication session. Chartlapse receives a stable Supabase user subject plus available email, display name, and linked-provider claims. Email sign-in also sends a short-lived one-time code through the configured mail delivery service.
Chartlapse uses the stable site-specific or Supabase identifier to scope cloud Project Documents to their owner. Email and optional display name are shown for the current session; cloud project rows do not store them. Original workbook bytes are not attached to the account.
Google and email sign-in with the same verified email may be joined by the identity service. You can also confirm Google from Account to add it to the same Chartlapse account.
AI planning and repair requests
If you use the remote planner (the external AI API via Chartlapse), the browser calls Chartlapse’s server route. That route forwards a minimized payload to the external AI API: locale, output mode, renderer choice, your prompt text, chat turns, and whether a local Excel file is present.
For uploaded workbooks, the external AI API is not sent Excel rows, cell values, or your original file name. Chartlapse may receive a generic local file marker and size for safety limits only, then redacts the name. API keys stay on the server. A local reference planner can plan without leaving your machine.
The separate public-data research command sends your request and retrieved public page excerpts and table previews to the external AI API with your consent. Selected public source URLs may be read directly from verified public publishers, or through Jina Reader and AllOrigins. It does not include uploaded workbook rows. Downloaded source data retain the public source links, selected cells and document hashes.
Chartlapse privately stores your research request, retrieved public source documents, completed steps and results for up to 7 days, subject to a per-request size limit, so an interrupted request can continue. Your browser keeps an opaque guest credential and request IDs for reconnecting; losing that browser session can prevent access to saved research. Expired research is inaccessible and is removed on subsequent research activity. Cancel research and Delete saved research erase the stored request, public documents and results. A deduplication tombstone and cost audit remain until expiry. Completed steps are reused; a sent call without a saved response is not automatically repeated or assumed refunded. Step accounting is retained through the following UTC month and purged on subsequent activity. Provider-side retention follows each provider's own policy.
When AI repair is available, Chartlapse shows a What leaves this browser preview with the exact field groups and counts before any provider request. The bounded repair payload can include your repair goal, table-shape and issue summaries, opaque preparation candidates and operations, and optional column profiles that contain header text, inferred kind, and ratios. If the protected provider route is unavailable, Smart Prep keeps the repair preview local.
AI repair requires source- and session-specific consent to that exact preview. A source, sheet, payload, or disclosure-version change invalidates consent. Original file bytes, raw table rows, cell values, formulas, comments, hidden sheets, file and sheet names or paths, source URLs and source identifiers, source hash, sheet index, mapping, recipe, generation, account/session identifiers, and API keys remain local and are not sent to the external AI API in the repair payload.
A repair response is an assistive proposal only. Chartlapse validates it against current local preparation choices, shows changes for review, and applies nothing without separate approval.
AI table conversion (Upload your own file — as it is)
When you choose “Upload your own file — as it is” and AI table conversion is available, Chartlapse first reads the table in your browser. Before the first send of each file in a browser session it asks inside the card and shows what would be sent. Only if you choose Send to AI does the browser send your table’s content — column names, labels and values — through Chartlapse’s server route to an external AI API, which suggests how to read the table.
Small tables are sent in full, and the card then says Whole table with its row and column counts. For larger tables, the rows above the header, the first and last rows, and rows that look like totals or notes are sent, and the distinct labels of category columns (up to 40 per column, which can come from any row, not only the rows shown), together with Chartlapse’s own notes on the table (its questions, suggested steps and cautions), up to 32 KB in all. The card shows all of this before you choose, and after a send a What was sent receipt shows exactly those rows, labels and notes.
Not sent: the file itself, the file name, sheet names, your account or session identifiers, formulas, comments, and workbook metadata. Text inside the table’s cells is table content and is sent like any other cell, including a title or note row inside the sheet even when it repeats the file or sheet name. Columns headed by a person-name word (for example Name, Manager, or Contact) are masked by default: their cells are replaced with placeholder tokens unless you choose Show names to AI for that column.
Nothing from a conversion request is stored on Chartlapse servers: the route keeps no copy of your table or of the suggestion and does not write them to logs, metrics, or analytics. The external AI API provider may process the request under its own terms and privacy policy; Chartlapse does not promise provider-side deletion. The AI’s answer is only a suggestion that Chartlapse checks against what was sent; nothing changes until you review and apply it.
Choosing Keep it in this browser sends nothing. Pasting or uploading a ready table and the blank template path make no AI request.
Browser storage
Opening the local Full player may write the current Project Document into sessionStorage so a new tab can play it. Choosing Sign in to save may also keep one pending Project Document there across the sign-in redirect; Chartlapse asks before uploading it and removes the pending copy after you save or keep it local. This storage is limited to your browser session/tab context. Closing the tab or clearing site data removes it.
After validation, Creator may keep the latest Project Document and compact reading choices in localStorage for up to 24 hours as a temporary recovery draft. Returning to Creator offers Restore or Discard before opening it. Reading choices let you reconnect the unchanged original file and verify its reading before restoring undo chips. The recovery entry excludes original workbook bytes, editable source rows, File/Blob handles, and undo history; clearing site data or choosing Discard removes it.
Signing in may set strictly necessary first-party session and PKCE cookies so the account can remain authenticated and OAuth redirects can be verified. Chartlapse does not set third-party analytics cookies.
Telemetry and logs
Chartlapse may collect cookie-less aggregate traffic (host platform page views / unique visitors) and first-party product funnel counts: sample start, data accepted, validation pass, first play, export complete, share create, plus short export-failure codes.
These events never include Excel rows, cell values, file names, category labels, notes, sources, or full prompts. Dimensions are limited to route, renderer id, still/animated mode, export format, and stable error codes. Operational logs must not store original Excel rows or full sensitive payloads.
Deletion
Workbook bytes and editable source rows clear when you leave or refresh the page, remove a file, or discard a plan. After a chart is validated, Creator may keep its Project Document and compact reading choices in this browser for up to 24 hours so a reload can recover the draft; it never stores the original workbook in that recovery entry. Downloaded JSON and your original Excel files are deleted only by you on your device. Shared Project Documents expire after 30 days; Chartlapse deletes the expired document and associated safety-report rows on access or through bounded cleanup.
A safety report stores one allow-listed reason and a per-link HMAC-protected network fingerprint. It does not collect a free-text message or store the raw network address in the report row. Repeats from the same network count once, and five distinct reports temporarily quarantine the link.
A signed-in owner can delete one cloud project immediately or delete all cloud projects attached to that site-specific account id. Signing out ends the Chartlapse authentication session but does not delete saved projects.
To request deletion of the authentication account record itself, use Support or email contact@chartlapse.com. Delete all cloud projects first if you also want the saved Project Documents removed immediately.
Third-party AI providers may retain minimized prompts under their own policies; Chartlapse limits what is sent so that surface stays small.
Questions
For product questions, privacy requests, or accessibility feedback, use Support or email contact@chartlapse.com.