How your data is protected
A plain description of how CleanYourDataset keeps your account and datasets private, and what it does to keep exported files safe to open.
- Access
- Every dataset request is checked against your account.
- Passwords
- Stored only as a one-way bcrypt hash.
- Session
- One HttpOnly, SameSite=Strict cookie.
- Scripts
- No third-party scripts, and a strict Content Security Policy.
Who can see your data
Datasets are private to the account that uploaded them. Every dataset request is matched against the signed-in account, and requests for another account’s dataset are answered as if it did not exist, so its name and contents are never revealed.
What is stored, and for how long, is described in the privacy note.
Passwords and sessions
- Passwords are stored as a one-way bcrypt hash, never as the password itself.
- Signing in creates a session that lasts 8 hours. Logging out ends it immediately in your browser.
- The session is stored in an HttpOnly cookie that page scripts cannot read, marked SameSite=Strict so other sites cannot send it, and Secure on HTTPS deployments.
- Repeated failed sign-ins for an account are slowed down, and sign-up attempts are limited per client.
Built-in protections
- Requests that change data are only accepted from this site’s own pages.
- A Content Security Policy only allows scripts, styles, fonts and connections from this site, and pages cannot be embedded in frames on other sites.
- Uploads are size-limited and strictly validated, and must be valid UTF-8.
- API requests are rate-limited per account, or per network address when signed out.
Safe exports
Exported cells that start with =, +, - or @ are prefixed with a tab, so spreadsheet apps treat them as text rather than running them as formulas. Your data is otherwise exported exactly as it appears in the workspace.
Deleting data
Deleting a dataset removes it, including its original rows and history, from the application database straight away. Deleting your account from the workspace account menu removes the account and every dataset in it.
If the operator of this deployment keeps database backups, deleted data may remain in those backups until they expire under the operator’s retention policy.
Reporting a problem
If you think you have found a security issue, please report it privately rather than in public, with the steps to reproduce it. See contact for how to reach the team that runs this deployment.