How we protect your account and data.

Last updated September 29, 2026

Your spreadsheets

• Sheet Studio opens and processes your files inside your browser. The contents are not uploaded to our servers.
• Project files you save can be protected with a password. They are then encrypted, and nobody, including us, can open them without that password.
• Sheet Studio can keep a working copy in your own browser so a refresh does not lose work. You can turn this off, and signing out clears it.

Your account

• A new account is created only after you enter a one-time code sent to your email.
• Passwords are never stored. We keep only a one-way code made with a deliberately slow, memory-hard method and a secret key, so even a stolen copy of our records would not reveal them. New passwords are checked against passwords already exposed in public data breaches.
• Your email address, name and the network addresses you sign in from are stored encrypted. Our own support tools show email addresses only partly.
• An account can be signed in on one device at a time. Signing in on another device asks first and then signs the other device out.
• We email you when your account is signed in on a new device or your password changes.
• Repeated failed sign-ins, codes, password resets and coupon attempts are limited.
• You get a one-time recovery code to reset your password if you forget it. It works once and we cannot read it.
• In My account → Security you can see your sign-ins with their network addresses, sign out other devices, download your data and delete your account.

RSAI

• RSAI receives only what you send, and you see file summaries, document text and photos before anything is sent. Your file itself is not uploaded.
• Voice is recorded only while the microphone button is on, and the recording is not kept.
• AI Studio conversations are kept only in your own browser and are cleared when you sign out.
• RSAI chat messages and data summaries are not stored after the answer. What RSAI remembers about you is kept as short notes, stored encrypted, that you can see and delete in AI Studio → Memory.
• What RSAI learns from conversations carries no name or account, never includes personal details, files or data summaries, and is checked before use.
• RSAI use is limited per hour and per day to prevent misuse.

Records we keep

• Sign-ins, account changes, payments and app events (for example "exported a report") are recorded to protect your account and help you if something goes wrong. They never include the contents of your files.
• These records are deleted automatically after 30 days.

The website

• All traffic is encrypted in transit, and browsers are told never to use an unencrypted connection to our site.
• Strict browser security rules allow only our own code to run on our pages, and our pages cannot be embedded by other sites.
• Requests that come from other websites are rejected, and every input is checked on our servers.
• We do not load third-party trackers or advertising scripts.
• The site runs on Cloudflare's network, which filters attacks before they reach us. Access to our administration tools is restricted.

Payments

• Card details are entered on Stripe's checkout page and never reach our servers. Payment notifications from Stripe are checked for authenticity and applied only once.

What you can do

• Use a strong password that you do not use anywhere else.
• Keep your recovery code somewhere safe, such as a password manager.
• Password-protect project files that contain sensitive data.
• Sign out on shared computers, and check your security history now and then.

Reporting a problem

If you believe you have found a vulnerability, please tell us through the contact form or at admin@astryven.tech with enough detail to reproduce it. Please do not access other people's data or disrupt the service while testing.