Privacy

When you paste, type or open a table, it is parsed by JavaScript already running in this tab. The figure is drawn as SVG in the page, and SVG and PNG exports are generated by your own browser. None of it is uploaded, none of it is stored on a server, and there is no endpoint on this site that would accept it.

That includes the “send to device” link and QR code: the dataset travels inside the link itself, after the #, which browsers never transmit to a server. It exists in the address bar of the two devices and nowhere else.

This site sets no cookies. It runs no analytics, no tag manager, no session recorder, no advertising pixel and no error reporter, and it loads nothing from another domain — no fonts, no scripts, no images from a CDN. That is why you have never been shown a consent banner here: there is nothing to consent to.

If that ever changes it will be a visible change with a new date on this page, and a cookieless measurement tool is the only kind that would be considered.

Three things, all of them on your machine and none of them sent anywhere:

• Your licence key, if you have one, under sp-license in localStorage. It is verified against a public key compiled into the page — the check is arithmetic in your browser, not a call to a server.
• Saved projects, if you save any, in localStorage. A project is your data plus your plot options. You can export one as JSON and delete it from the projects menu.
• Two preferences: your light/dark choice, and a per-tab note of which sample datasets you have cleared so they do not reload themselves.

Clearing site data for this domain removes all of it. Nothing is recoverable from our side afterwards, because nothing was ever on our side.

Buying a licence is the one thing here that touches a server. Three small endpoints exist and they are the whole of it:

• one that opens a Stripe checkout session from a plan name — “pro” or “lifetime” — and nothing else;
• one that exchanges the Stripe session you are redirected back with for a signed licence key;
• one that Stripe calls when a payment completes, which sends the licence email.

None of them receives a number you have plotted. There is no database behind them — there is no database at all — so no customer record, no order history and no copy of your licence key exists on this side. Server logs are written without the key and without your address.

Stripe is the payment processor and holds the payment record: your email address, your card details, the amount, and the billing and country information Stripe needs for tax. Card numbers never pass through this site — checkout happens on Stripe's own pages. Stripe's handling of that data is governed by its own privacy policy.

Resend delivers the licence email. It receives the address you paid with and the message, which contains your key.

Vercel hosts the site and, like any web host, records standard request logs — IP address, timestamp, the URL requested, the browser's user-agent string — for a limited period. That is the one category of data collected about you that this site cannot see the inside of, and it is collected about every visitor to every site on the internet.

For plot data and saved projects there is nothing to request: they are already only in your hands, and clearing site data deletes them.

For the payment record, write to help@strataplot.com and it will be looked up in Stripe and actioned. Deleting the payment record does not revoke a licence key you already hold — the key is self-contained and nothing checks in with a server.

The purchase terms, including the all-sales-final policy and what a licence permits, are on the terms page.