Your file starts private.

The free CSV workspace is local-first. Opening, searching, sorting, filtering, editing, cleaning, and exporting a file happens on your device unless you deliberately use a feature that says it will upload or publish data.

We collect the minimum information needed to operate CommaRelay, respond to you, protect the service, and provide optional hosted features.

Files and dataset content. Local workspace files are processed in your browser. Publishing uploads your CSV to private storage and stores its rows, edits, and retained versions in our database. Hosted data is processed by our hosting, database, and storage providers so we can deliver the access you configure. MCP and AI features are not part of this release.

Contact and waitlist details. When you submit a form, we receive the information you enter, including your name, email address, topic, and message. Form email is delivered through Resend.

Account and service data. We process account identifiers, verified email addresses, invitations, plan information, storage usage, security events, and basic request diagnostics. Stripe handles payment details; sign-in codes and invitation emails are delivered through Resend.

We use information to deliver requested features, respond to messages, maintain security, prevent abuse, diagnose reliability issues, measure service limits, improve the product, and comply with legal obligations.

We do not sell personal information. We do not use the contents of a locally opened CSV because that content is not sent to us.

We may share the minimum necessary information with infrastructure, email, authentication, storage, database, monitoring, and payment providers that help operate CommaRelay. We may also disclose information when required by law, to protect rights or safety, or as part of a business transaction.

Pro retains five dataset versions and Team retains twenty. Older versions are removed from the restore list and their stored rows are reclaimed in the background. Temporary uploads and import checkpoints are scheduled for cleanup after completion or failure; abandoned uploads expire after 24 hours. Cleanup can be delayed by service outages.

Pausing a link or revoking an invitation blocks future access but does not erase copies a recipient already downloaded or viewed. Canceling a subscription does not automatically delete hosted data. Owners retain access to export or delete their datasets.

Deleting a dataset removes its content and history in the background. A minimal link record is retained so the old URL cannot be reassigned to another dataset. Backup copies may remain until their retention period expires and are restricted to recovery operations.

We keep information only as long as reasonably necessary for the purpose collected, contractual commitments, security, dispute resolution, and legal requirements. Local files remain subject to your browser and device settings.

No service can promise perfect security. We use reasonable administrative and technical safeguards and design hosted access around explicit permissions and least-privilege controls.

Dataset owners can manage invitations, pause and re-enable links, export data, and delete datasets from sharing settings. For account deletion or help with data you cannot manage yourself, choose “Account or data deletion” on our contact form. We verify ownership before acting; do not send passwords, sign-in codes, or CSV contents.

You may choose not to use hosted features, avoid including sensitive data in contact messages, and delete local browser data through your browser controls. You may request access, correction, or deletion of personal information by using the contact form.

CommaRelay is not directed to children under 13. We may update this policy as the product changes; the date above identifies the latest revision.

Questions about this policy can be sent through our contact page or to hello@commarelay.com.