Privacy Policy

Effective October 5, 2026

This policy explains what information CheatSheet collects, why, who else touches it, and what you can do about it. CheatSheet is run by CheatSheet LLC ("we", "us"). The short version: we use your data only to run CheatSheet for you, we never sell it, and we never show ads.

1. What we collect

• Account details: your email address, password (stored scrambled, never in plain text), your company's name, and your role in the company.
• Your company's data: the spreadsheets, documents, photos, forms and project information your team uploads or types in, plus the questions you ask the assistant and its answers.
• Billing details: your plan and payment status. Card numbers go directly to Stripe; we never see or store them.
• Security records: sign-in times, IP address, and device/browser type, used to protect accounts (blocking repeated wrong passwords, flagging sign-ins from a new device). We also keep an activity history of changes made in your company, which your owner and admins can see.

We don't use advertising trackers or third-party analytics. Your browser stores a sign-in token so you stay signed in; apart from the demo hand-off and a referral code (both below), that's the only thing we keep in your browser.

The demo at /try. A file you drop into the demo is read inside your browser and never uploaded: we never receive its contents or its name. If you then create an account to save that dashboard, the figures CheatSheet read from it (not the file) are kept in your browser for up to a day, so they can be saved to your new account after you confirm your email; they are removed once saved. To see how the demo is used, we count events: the page opened, the sample opened, a file dropped (its type and a size range only), a dashboard shown, a file the demo couldn't read (the reason only), which locked feature was clicked, and sign-up started or finished. These counts carry no file contents, file names, email addresses or IP addresses. The demo never sends anything to Anthropic.

The Tracking Finder at /finder. Your answers to its three questions stay in your browser and are not saved. We count events only: the Finder started, which role was picked, the Finder finished, which trackers it recommended, and a PDF downloaded. These counts carry no other answers and no personal information. If you start a free trial from it, the names of the trackers you ticked are carried in the confirmation link so they can be added to your new company; nothing else is. The Finder never sends anything to Anthropic.

Referral links, Quick Start and "Talk to us". If you open a CheatSheet referral link, its code is kept in your browser for up to 60 days so it can be applied if you sign up, and the referring company sees a count of how many times its link was opened (no names, email addresses or IP addresses). If your company signs up through a link, the referring company sees your company's name and whether it has signed up and paid, nothing else. If you send the "Talk to us" form, we keep what you typed (name, company, email, phone, number of projects, note) and email it to ourselves so we can reply. If you buy Quick Start, we keep a record of the purchase and email ourselves your company's name, contact email and plan so we can schedule it.

2. How we use it

• To run CheatSheet: show your dashboards, answer your questions, fill your forms, and send emails you've asked for (like the weekly digest and security alerts).
• To keep accounts and data secure.
• To bill your company and send account notices.
• To give support when you ask for it.

We never sell your data, never share it for advertising, and never show ads.

3. Who we share it with

We use a few service providers to run CheatSheet. Each gets only what it needs to do its job for us:

• Supabase — hosts our database, file storage and sign-in. Your data is stored in the United States (US East).
• Anthropic — when you ask a question, update from a document, or fill a form, the relevant documents and data are sent to Anthropic's Claude API to read them and write the answer.
• Stripe — handles subscriptions and payments.
• Resend — delivers our emails (sign-up confirmation, password resets, digests, security alerts, email-update replies), and receives the emails you forward to your CheatSheet address and passes them to CheatSheet.

The full list — every provider, what it does, what data it handles and where — is on our subprocessor list.

We may also share information if the law requires it (for example, a valid subpoena), to protect people's safety or our rights, or as part of a merger or sale of the business — in which case this policy keeps applying to your data.

4. Your company is kept separate

Every company's data is isolated from every other company's. The database itself checks that each request comes from a member of that company, so one company can never see another's projects, documents or answers. Inside your company, people see what their role allows.

5. No CUI or classified information

CheatSheet is not certified for Controlled Unclassified Information (CUI), CMMC or FedRAMP. Please don't upload CUI, classified information, or export-controlled data. See section 5 of the Terms of Service.

6. Your choices and control

• Export: your company's owner or admin can download all of your company's data at any time from Company settings, and uploaded files can be downloaded from each project's document library.
• Delete: you can delete documents at any time. To close your company's account and delete its data, email fletcherscott0829@gmail.com.
• Access or correct: email us to see or fix the personal information we hold about you.
• Emails: you can turn off the weekly digest. We'll still send emails needed to run your account, like password resets and billing notices.

Because your company signed up for CheatSheet, your company decides what's in its account. If you're an employee and want something about you removed from company data, ask your company first; we'll help them do it.

7. How long we keep it

We keep your company's data while its account is open. After an account closes, we delete its data within a reasonable time, except where we need to keep records for legal, tax, billing or security reasons (for example, payment records and the security activity history). Backups are overwritten on a rolling schedule.

8. Security

Data is encrypted in transit and at rest. We offer two-step sign-in, sign people out after inactivity, limit repeated sign-in attempts, and alert company owners about sign-ins from new devices. No system is perfectly secure, but if we learn of a breach affecting your data, we'll tell you promptly and as the law requires.

9. Children

CheatSheet is a business tool and isn't meant for anyone under 18. We don't knowingly collect information from children.

10. Changes to this policy

If we make a significant change, we'll email your company's owner before it takes effect and update the date at the top.

11. Contact

Questions or requests about your data:
CheatSheet LLC
711 Bellshire Dr, Orange Park FL 32065
fletcherscott0829@gmail.com