Privacy Policy

Last updated October 29, 2026

This Privacy Policy explains how AskCSV ("AskCSV," "we," "us," or "our") handles information when you use our website at https://askcsv.com and the AskCSV app (the "Services"). Questions? Contact us at help@askcsv.com.

Summary of Key Points

• Trying AskCSV does not require an account. You can try AskCSV as a guest without signing in. Google sign-in is required to subscribe and buy credits; it does not upload the files already open in your browser.
• Your file stays in your browser. A CSV, TSV or Excel file you open is read and queried with DuckDB inside your browser. It is not uploaded, and we do not store a copy of it on our servers. Files, chats, charts and results are stored in this site's storage on your device.
• We keep what our AI provider sees to a minimum. To write the SQL and explain an answer, OpenAI receives only your question, the name and row count of each file or sheet in the chat, the names and types of the columns you chose to share, up to 10 sample rows from those columns, up to 100 rows of the query result your browser computed with figures derived from it, and the earlier messages in that chat. Your file itself is not sent, and columns you turn off are left out.
• Guest accounts and their trial credits expire after 7 days. Your files and chats are not affected by that expiry; they stay in your browser until you delete them or clear the site's data.
• We keep limited account, usage, and billing records. If you sign in, we store the Google account details needed for authentication, credit balances and token usage, and the Stripe customer, subscription, Checkout, and payment references for your subscription and credits. Payment details are processed by Stripe; AskCSV does not receive your full card number.
• Product analytics is anonymous and cookieless. We measure aggregate, pathname-only usage with a privacy-hardened analytics tool that stores nothing on your device (no cookies and no persistent identifier) and never receives personal information or your file contents. It honors browser Do Not Track and Global Privacy Control signals. AskCSV does not use advertising or advertising cookies.
• We do not sell your personal information.

1. Information We Collect

Files and analyses in your browser. When you open a CSV, TSV or Excel file, it is read and queried inside your browser and stored in this site's storage on your device. We do not receive the file or the charts. Query results and your conversation history are kept in your browser; only the parts described in Section 2 pass through our server to the AI provider, and we do not store them on our servers.

Questions and technical records. For each question, our server processes the request so the AI provider can write the SQL and explain the result, and keeps technical records: a hash of the request context, the model and token counts, the charge, and the turn status. The question text, the shared sample, the SQL, the query result and the answer are not stored on our servers.

Account information. If you sign in with Google, we receive the name, email address, profile image, and account identifier needed to create and authenticate your account, along with the session records needed to keep you signed in.

Usage records. We keep your credit balance and its expiry dates, your subscription status and current period end, the token usage charged for each answer, and technical records such as request timestamps, in order to apply limits, prevent abuse, and operate the Services.

Purchases and subscriptions. If you subscribe or buy credits, we store the Stripe customer and subscription references, the Checkout session reference, the current period end, the amount credited, and any refund or dispute that changes it. Stripe processes your payment details, the subscription, the Customer Portal, and receipts. Stripe sends a receipt to the billing email on your Stripe customer — for a subscription this may differ from your AskCSV account email, and whether one is sent follows your Stripe notification settings. AskCSV does not receive or store your full card number.

Technical and security data. Our hosting and security providers process standard request information such as IP address, browser type, device characteristics, referring page, requested pathname, timestamps, and security logs.

2. How Your Files and Questions Are Processed

Query execution in your browser. Questions are answered by running read-only SQL against your file with DuckDB inside your browser. A query can select, filter, group, and aggregate; it cannot modify or delete your data, and it cannot reach files or the network.

AI context kept to a minimum. AskCSV uses OpenAI as its AI provider for answers. For each question, OpenAI receives only the following. To write the SQL, it receives your question, the name and row count of each file or sheet in the chat, the names and types of the columns you chose to share, up to 10 sample rows from those columns, and the earlier questions, answers and SQL in that chat. To explain the answer, it then receives the result of the query your browser ran — up to its first 100 rows (16 KB), from shared columns only — with short facts computed from the whole result: totals, counts, shares, trends, and its highest and lowest rows. A result can contain real rows: if you ask for the five largest orders, those five rows, in the columns you share, are sent. If a query fails, the AI is told the kind of error, never the error text. Columns you turn off are left out of the sample, the results and the totals, and earlier answers that used them are left out of the chat history. These limits are part of a fixed request format that your browser and our server both check; our server refuses a request that exceeds them or includes anything else. Columns that look sensitive — email, phone, identifiers, long text and secrets — are off by default. The line under the question box summarizes what is sent with each question, and Review shows the exact sample and lets you turn columns on or off. If you share no columns, the sample is empty and only your question, the file names and row counts, and the earlier messages in the chat are sent.

AI-provider storage. AskCSV sends Responses API requests with store: false, so responses are not stored for later API retrieval. This is not a zero-retention guarantee: OpenAI may retain abuse-monitoring logs for up to 30 days by default, or longer where legally required. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. See OpenAI's API data controls for details.

Deterministic results. Totals, counts, shares, and trends are computed in code from the query result in your browser. The AI explains the result rather than producing the figures, and the generated SQL is shown with every chart so you can verify it.

No direct database connections. AskCSV analyzes files you open. It does not connect to your own databases or warehouses.

3. How We Use Information

We use the information described above to:

• provide the analysis service, including planning SQL and generating explanations;
• keep the local browser records that let you return to your work;
• authenticate users and keep your credit balance;
• process and support billing through Stripe;
• apply usage limits, rate limits, and abuse prevention;
• secure the Services and troubleshoot failures;
• understand aggregate, anonymous product usage through cookieless analytics.

4. Cookies and Similar Technologies

Essential storage includes the authentication session for signed-in users, the local browser records required for app preferences such as the color theme, and the files, chats, charts and results you open, which are stored only in your browser.

Anonymous product analytics (no cookies). We use a privacy-hardened analytics service (PostHog, US region) to understand aggregate product usage. It is configured to store nothing on your device — no cookies and no persistent identifier — and to run fully anonymously, with autocapture and session recording disabled. Because it stores no information on your device and does not collect personal information, it operates without a separate consent step. It honors browser Do Not Track and Global Privacy Control signals, which turn it off automatically.

AskCSV's product analytics sends pathname-only page views and allowlisted funnel events with fixed categories or buckets. We do not intentionally send URL search parameters or hashes, filenames, file contents, questions, SQL, column names, chart data, names, email addresses, or OAuth or Stripe identifiers in analytics events.

AskCSV does not show ads and does not load advertising or cookie-based analytics scripts.

5. Third-Party Services and Sub-processors

OpenAI (AI provider). OpenAI receives the question, the file or sheet names and row counts, the names and types of the columns you chose to share, up to 10 sample rows, the earlier messages in that chat, and up to 100 rows of the query result the browser computed with figures derived from it, as described in Section 2. See OpenAI's privacy policy and API data controls for its own terms and retention practices.

Google OAuth. Google processes sign-in when you create or access an account, including a free account. See Google's privacy policy at https://policies.google.com/privacy.

Stripe. Stripe processes payment details, Checkout, subscriptions, the Customer Portal, receipts, and refunds for your subscription and credit purchases. See Stripe's privacy policy at https://stripe.com/privacy.

PostHog (product analytics). We use PostHog Cloud (US region) for anonymous, cookieless product analytics as described in Cookies and Similar Technologies. PostHog processes only the pathname-only page views and allowlisted funnel events we send, with no cookies or persistent device identifier. See https://posthog.com/privacy.

Vercel (hosting and content delivery). The web application and its API are hosted and served by Vercel, which processes standard request information such as IP address, browser type, device characteristics, requested pathname, timestamps, and security logs. It does not receive the files you open in your browser. See Vercel's privacy policy.

Oracle Cloud Infrastructure (database). Account, credit, billing, and turn metadata are stored in a MySQL database on Oracle Cloud Infrastructure (HeatWave). It does not receive the files you open in your browser. See Oracle's privacy policy.

6. Retention and Deletion

Guest accounts. If you use AskCSV without signing in, the guest account and its trial credits expire 7 days after they are created. Files and chats stay in your browser until you delete them or clear the site's data.

Your files and chats. They are stored in your browser, not on our servers, and stay until you delete them there.

Account, usage, and purchase records. We retain account, authentication, usage, and purchase records for as long as needed to provide the Services, apply limits, maintain security, resolve billing issues, and meet applicable legal obligations. Stripe retains payment and transaction information according to its own policies and legal obligations.

Your deletion controls. You can delete any file or chat in the app, and you can clear this site's data in your browser, which removes everything stored there. Deleting your account removes your account and its server-side records, and clears its files and chats from the browser you delete it in; other browsers keep their copies until you clear this site's data there.

To ask about deletion of account information, contact help@askcsv.com. Deleting your account also removes any remaining credits; request a refund of eligible purchased credits first.

7. Security

Everything sent with a question — including the sample and the query result — is transferred over HTTPS. Your file is read in your browser and is not uploaded. Queries run in a read-only SQL engine that cannot modify or delete your data and has no file or network access. No system is perfectly secure, so we cannot guarantee absolute security, and you should avoid processing data you are not permitted to process.

8. Your Choices and Rights

• Try it without an account. Guest analysis needs no Google sign-in.
• Delete your data. Remove any file or chat in the app, or clear this site's data in your browser to remove everything stored there.
• Turn off analytics. Anonymous product analytics is cookieless and honors browser Do Not Track / Global Privacy Control signals, which turn it off automatically.
• See your credits and subscription. Your balance, purchases' expiry, subscription status, and receipts (sent by Stripe to your billing email) are available to you; manage or cancel the subscription in Settings, and ask help@askcsv.com for a refund of eligible purchased credits.
• Regional rights. Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal information. Contact help@askcsv.com to make a request about information held by AskCSV. For data held by Google, Stripe, or OpenAI, their request processes also apply.

9. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children.

10. Updates to This Notice

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above.

11. Contact

Questions about this notice? Email us at help@askcsv.com.