CLEAR ANSWERS ABOUT YOUR DATA

Privacy policy

Your CSV stays in your browser. This page explains website request logs, the private visitor dashboard and optional analytics.

Last updated: 3 November 2026

The short version

We do not upload your CSV files, filenames or pasted text. Our web server keeps request logs. Optional site analytics recognizes returning browsers and measures demo ad interactions only after you allow it. Google Analytics measures visits and basic usage only after you allow it separately. We do not run advertising pixels, session replay or fingerprinting scripts.

About this notice

This notice describes how the CSV tool at web.treach.xyz handles information.

What we process, and why

Data	What happens to it	Purpose
CSV files and pasted text	Processed in browser memory. Contents, headers, filenames and converted downloads are not sent to our server or Google Analytics.	Detect separators, show a preview, check records and produce your download.
Website request logs	Our server logs the connecting IP address, timestamp, request URL and method, response status and size, browser user-agent and referring URL when supplied. URLs can contain query parameters. Error logs may include related request details.	Deliver the website, diagnose errors, maintain reliability and investigate abuse.
Private visitor dashboard	Known page paths, IP address, browser string, timestamp, response status and size, referring website origin, HTTP protocol and selected request headers. The header allowlist includes Host, User-Agent, Accept, Accept-Language, Accept-Encoding, browser client hints and Fetch Metadata. Referrer headers are reduced to website origin; values are length-limited. Authorization, raw Cookie headers, CSRF tokens, request bodies, queries, unknown path names, CSV data and admin activity are excluded. Headers were not recorded in older dashboard requests. Requests with the same IP, browser string and visitor reference (when available) are grouped until 30 minutes of inactivity.	Monitor website traffic, reliability and possible automated requests. Sessions and browser labels are estimates.
Optional site analytics	If you allow site analytics, your browser sends a random visitor ID with later requests to this site. Only this designated cookie value is included in the dedicated request log; the dashboard database stores a SHA-256 reference instead of its raw value. No full Cookie header or sign-in cookie is recorded by the dashboard.	Recognize this browser across saved sessions and connect consented demo-ad events to an estimated session. A returning label means an earlier matching session exists within the retained 14-day history; it does not identify a person.
Demo ad measurements	After site-analytics consent, the demo sends ad identifiers and version, load/view/click/error/summary events, temporary page/event IDs, browser timestamps, language, time zone, screen/window/ad dimensions, pixel ratio, orientation, navigation type and online state. Reports include creative download status, timing and size when available, visibility estimates and durations, click delay, and a snapshot of the accepted consent choice/version/time. Only short letters/digits/underscore/hyphen values from utm_source, utm_medium and utm_campaign are retained; other URL parameters are excluded. The server adds IP, user-agent, reported browser/OS/model information where supplied, receipt time and approximate country/region from a local DB-IP database. Visitor IPs are not sent to DB-IP. No CSV data, form values, precise location or hardware identifiers are included.	Test ad rendering and engagement. An estimated view means at least half the ad intersects the viewport continuously for one second while the tab is visible. It does not prove human attention. Events may be blocked, lost, delayed or spoofed; these are test measurements, not verified advertising revenue.
Analytics preference	Your Allow or Decline choice, version and timestamp are stored on your device. Each consented demo event also saves a snapshot of the accepted choice and timestamp in the dashboard.	Remember and respect your choice.
Optional usage analytics	If you opt in, Google Analytics receives page visits and the fixed events csv_analyzed and csv_downloaded, plus standard browser/device, session and approximate-location information. Google may also measure interactions such as scrolling and outbound link clicks. CSV contents and filenames are not included. Before loading Analytics, we remove unused URL queries and fragments from the address bar; our measurement calls exclude referrer values.	Understand visits and whether the tool is useful. Detection events include use of the example; a download event records a download being initiated, not proof that a file was saved.

Server logs are separate from Google Analytics. The connecting IP may belong to a VPN, proxy or shared network; it is not a verified identity or precise location. Do not put personal information in the website URL. Send only a small, invented example when reporting a CSV issue.

Cookies, local storage and your choice

Open to see the current analytics status or change your preference. The detector works whether you allow or decline either optional cookie purpose. Site analytics (including its visitor cookie and ad measurement) and Google Analytics have independent choices. The expanded site-analytics purpose uses a new consent version: older choices need to be renewed before expanded ad measurements start. The older visitor cookie and consent record are retired when this version runs; the new consent storage is isolated from older open pages. No Google Analytics script or measurement request is loaded by our code before opt-in.

Storage	When used	Duration
`__Host-treach_visit_v3` cookie	A random browser identifier created only when you allow site analytics. Secure, SameSite=Lax, restricted to this host. It carries no CSV content and is not a login token.	Up to 90 days from your choice, without extending on page views. Browsers may delete it sooner. A deleted cookie is not automatically recreated.
`treach-site-analytics-v3` (local storage)	Your site-analytics choice, version and timestamp. It does not contain the visitor ID or CSV data.	Valid for up to 90 days; expired records are removed when the site is opened. You can change your choice in Cookie settings.
`treach-analytics-consent` (local storage)	Records your analytics choice. It does not contain CSV data.	We treat the choice as valid for 180 days. Expired records are removed when the site is next opened; you can clear site data sooner.
`_ga` and `_ga_…` cookies	Google Analytics identifiers, only after analytics opt-in. They are scoped to this subdomain.	Configured to expire after 180 days without extending expiry on every page load; your browser may delete them earlier.

A necessary __Host-treach_admin cookie is set only when an administrator signs in. It is Secure, HttpOnly and SameSite=Strict. Sign-in expires after 30 minutes without dashboard requests or after 8 hours, whichever comes first. The optional visitor cookie is separate from this sign-in cookie. You can decline site analytics or withdraw using Cookie settings. Withdrawal deletes the visitor cookie and stops future optional ad events and cookie-based recognition; it does not remove existing server records.

Declining or withdrawing Google Analytics disables its further measurement by our code and removes accessible Analytics cookies for this subdomain. It does not erase data already sent to Google. Clearing browser storage, using another browser or switching devices may require another choice.

How long data is kept

CSV working data: held in browser memory while you use the tool. Clear removes the input, preview and worker data. Downloaded files stay on your device until you delete them.
Private dashboard: a 14-day history of requests, selected headers and consented ad events with browser-reported device details, with older records removed on an hourly cleanup cycle. Administrators can reset dashboard history; this clears requests, saved headers, ad events and returning-browser history, but does not erase cookies on visitors’ devices or separate server, security or provider logs.
Server logs: configured for daily rotation, retaining 14 rotated files. Empty logs are not rotated, so this is not a strict 14-day deletion guarantee. The dashboard does not control any separate hosting-provider records or backup copies.
Analytics: Google Analytics user and event data retention is governed by the property setting, separate from the 180-day browser cookie lifetime. Aggregated reports may be retained for longer.

Your choices

You can use the tool without either optional cookie purpose, clear the working CSV data, and remove this site’s cookies and local storage through your browser. Declining or withdrawing site analytics stops optional ad measurements and future cookie-based recognition; it is not recreated automatically if you delete it. Declining analytics does not prevent ordinary web-server request logging. We cannot retrieve CSV content that was never uploaded.

Updates to this policy

We will update this page when the site’s processing changes. The date above identifies the latest revision. Material changes to optional analytics will be reflected in the consent choices.