Privacy policy

What personal data DreamSheets collects, why, who processes it, how long it is kept, and the rights you have over it.

Last updated: 12 August 2026

DreamSheets is a desktop spreadsheet application operated by David Curtis ("DreamSheets", "we", "us"). This policy explains what personal data we handle, why, and what you can do about it. It covers the DreamSheets application, the DreamSheets Cloud service, and the dreamsheets.app website.

The short version. DreamSheets is local-first. Your spreadsheets stay on your computer unless you deliberately save them to DreamSheets Cloud. We do not sell personal data, we do not use your documents to train AI models, and we do not run advertising or third-party tracking on our website.

Who is responsible

For personal data described in this policy, the data controller is David Curtis, contactable at dc8curtis@gmail.com.

Where you use DreamSheets Cloud to store documents that themselves contain personal data about other people — your customers, employees, or contacts — you are the controller of that data and we act as your processor. Business customers should use our data processing agreement for those arrangements.

What we collect, and why

If you only use the desktop application

Nothing. The application requires no account and transmits no personal data. Your documents, settings, and credentials remain on your device. This is the default state.

The application checks for updates, which involves a request to our update server. That request reveals your IP address and the app version, as any HTTP request does, and is not used to build a profile.

If you buy a license

• Data: name, email address, and the details of your purchase.
• Why: to take payment, issue your license key, email it to you, and provide support.
• Legal basis: performance of a contract.
• Payment cards: handled entirely by Stripe on Stripe's own hosted checkout page. Card numbers never reach our systems. We store only Stripe's transaction identifiers, the amount, currency, and status.

If you use DreamSheets Cloud

• Data: your email address and authentication credentials; the documents you save, including their contents, names, and folder structure; the email addresses of people you share with; version history and merge records; and timestamps.
• Why: to provide the storage, sharing, sync, and version-history features you asked for.
• Legal basis: performance of a contract.
• Note: documents may contain personal data about third parties. That content is yours; we process it only to run the service, never for our own purposes.

If you turn on usage metrics

• Data: a random installation identifier, app version, operating system, whether you are on the free or trial tier, and counts of eleven named actions. Optionally, crash records containing a source-code location and build version.
• Why: to understand which features are used, so development effort goes to the right place.
• Legal basis: consent, which you may withdraw at any time in the application's settings.
• Note: this is off unless you switch it on, stops permanently once you buy a license, and contains no free-text field. It cannot carry cell values, file names, or column names. The installation identifier is created only at the moment you opt in.

If you use AI features

AI features do nothing until you configure them: you supply your own API key for an AI provider you have chosen, and requests go from your machine to that provider under your own agreement with them — we do not proxy, log, or see those requests. If you prefer, the application can hide every AI feature from its interface entirely (AI → Hide All AI Features).

By default these requests include your table structure and a five-row sample of each table, so the assistant can work with real data. You can switch that off in the application's AI settings ("Don't send cell data to AI"), after which only structure is sent and external AI tools connected over MCP are refused access to cell values entirely. Two behaviours are fixed regardless of that setting: the formula translator sends no cell values at all, and the import analyzer replaces every number, date, and boolean with a placeholder.

Because you choose the provider, that provider's own privacy terms — including whether it retains prompts or trains on them — govern what happens to anything you send. Review them before enabling cell data for confidential work.

If you visit our website

Standard server logs (IP address, user agent, requested page) are produced by our hosting provider for security and reliability. We do not run advertising networks, third-party analytics, or cross-site tracking, and we set no non-essential cookies. Cookies are used only to keep you signed in.

• Downloads: when you download the application while signed in, we record your account, the platform you downloaded for, the country our hosting provider derives from your IP address (never the IP address itself), and the time. This tells us where the application is being used; it is not used to build a profile.

Who else processes your data

We use the following providers. Each is bound by a contract restricting them to processing data on our instructions.

Your chosen AI provider and any external database you connect to are not our sub-processors — those are your own relationships, configured by you.

If you are in the United Kingdom or European Economic Area, transfers to these providers rely on Standard Contractual Clauses or an equivalent approved transfer mechanism.

How long we keep it

• Cloud documents and version history: until you delete them, or until you close your account.
• Account and license records: for as long as your license is valid, and afterwards for as long as needed for tax and accounting obligations — typically six years.
• Usage metrics: aggregated by day and retained for up to 24 months.
• Server logs: short-lived, per our hosting providers' retention defaults.

Deleting a document removes it and its stored blobs. To close your account entirely, email us.

Your rights

Depending on where you live, you have the right to access the personal data we hold about you, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where processing is based on consent. Because DreamSheets is local-first, much of your data is already in your hands as ordinary files.

To exercise any of these, email dc8curtis@gmail.com. We will respond within one month. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office.

If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

Security

Security measures are described in detail on our security page. In summary: local-first storage, credentials held in your operating system's credential manager, TLS in transit, encryption at rest with our infrastructure providers, database-enforced access control for cloud documents, cryptographically signed application updates, and automated dependency vulnerability scanning.

If we become aware of a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where required, and notify you without undue delay where the breach is likely to present a high risk to you.

Children

DreamSheets is a business tool and is not directed at children under 16. We do not knowingly collect their personal data.

Changes

If we change this policy materially, we will update the date at the top and, for significant changes affecting cloud or account customers, notify you by email.

Contact

David Curtis — dc8curtis@gmail.com