Privacy policy

Every tool, template, dataset, function page and article on excelback.com works with no account, no login and nothing collected about you — that has not changed. Ebooks are the one exception: reading any ebook here still needs nothing at all, but downloading the PDF (or, for the premium title, its companion workbook) requires signing in with Google at /account. If you only ever read, the rest of this page describes you exactly: no database row, no cookie, no server-side record of your visit.

What we collect

Nothing that identifies you, unless you choose to sign in. To be specific about what that means, because "we value your privacy" is not information:

• Accounts are only required to download an ebook. Reading a tool, template, dataset, function page, article, or any ebook never requires signing in. Downloading an ebook's PDF (or the premium title's companion workbook) does, via the Google sign-in at /account — we store the name, email address and profile photo Google gives us, nothing else, and nothing more than Google itself already has. If you don't sign in, there is nothing to store, because there is nothing to sign in with.
• Cookies, only if you sign in. Signing in sets one cookie identifying your session, so the site knows you're signed in on your next visit; a second, short-lived cookie exists only for the few seconds of the Google redirect itself. Neither is set for anyone who never uses sign-in. See the cookie policy for the full list, including what the third-party embeds can do.
• Almost no persistent local storage. Nothing is written to IndexedDB, ever. A few on-page prompts (the donate bar, and small banners suggesting a relevant tool, template, or article) use sessionStorage to remember that you dismissed them, erased the moment you close the tab. The one localStorage entry on the whole site is set only if you subscribe to the email newsletter (see below) — a single flag so the signup popup doesn't ask again, nothing that identifies you beyond that. See the cookie policy for the exact list of what that covers.
• No cross-visit tracking, unless you signed in or subscribed. Close the tab and no trace of your visit remains on your device — sessionStorage is gone with it, and there is no cookie or persistent identifier to bring back on a return visit. The two exceptions are both deliberate and both things you did on purpose: a session cookie if you signed in, and the newsletter flag above if you subscribed.
• One form that submits somewhere: the email newsletter. The popup offering email updates sends your email address to our server, where it's stored (in a database table separate from the sign-in one above) so we can send you the updates you asked for. Every email includes a one-click unsubscribe link; using it deletes nothing but marks you as unsubscribed immediately. The two search boxes remain method="get" forms pointing at /search on this site — your search term goes into the address bar and nowhere else.
• No contact form. The contact page is a mailto: link. If you email us, that email is handled by your mail provider and ours in the ordinary way.

What the tools do with your data

All three tools — the formula builder, the formula explainer and the CSV cleaner — run entirely in your browser. Nothing you type or open is uploaded, because there is nothing to upload it to.

The CSV cleaner reads files with the browser's own FileReader. Your file is parsed in the page, in memory, on your machine. It is never transmitted, never written to a server, and never seen by us.

That said: this is a public website, and you should treat it like one. Confidential, regulated, personal or client workbook data does not belong in any web page, ours included. If a workbook would need approval to email, it needs approval to paste here.

The requests a page does make

Loading a page on this site contacts no third party at all.The pages, styles, images and fonts all come from this domain. There is no CDN script, no tag manager, no embedded widget and no font service.

The typefaces are a case in point: they used to load from Google, which sent your IP address to Google on every page view. They are now served from this domain, so that no longer happens.

Two exceptions exist, both YouTube, and both narrower than "we use third-party services":

The embed is worth being precise about. The player's src is empty until you open a video, and it is stripped again when you close it. Until you deliberately press play, no request reaches YouTube. We use the youtube-nocookie.com domain, which is YouTube's own privacy-enhanced mode.

Whoever hosts this site also keeps ordinary server logs, which include IP addresses, for security and abuse handling. That is a function of putting anything on the internet rather than a choice we made about you.

Analytics

This site is built to run either with privacy-preserving, aggregate analytics or with none at all, and which one is live depends on configuration rather than on code. When analytics is switched off, no vendor script is requested, no tag is rendered, and there is nothing in the page to find.

When it is switched on, these are the rules it is built to:

• Cookieless and aggregate. Counts of pages and clicks, not profiles of people. No cross-site tracking, no advertising identifiers, no attempt to recognise you on a later visit.
• Do Not Track and Global Privacy Control are honoured. If your browser sends either signal, the analytics script is never requested — not requested and then ignored. Nothing about your visit is measured.
• Outbound clicks are counted. When you follow a link to a third-party resource we record that a link in a given position was clicked, along with the destination domain and whether it was an affiliate link. No personal data is attached, because none is available to attach.

Links to other sites

Most of what this site does is point you at other people's work: hundreds of curated resources, courses and channels. Once you follow one of those links you are on someone else's site, under their privacy policy, and we have no visibility into or control over what they do. Outbound links carry rel="noopener noreferrer", so the destination is not told which page you came from.

Children

This is a spreadsheet reference. It is not aimed at children, and it collects nothing from anybody, so there is no children's data here to protect or to delete.

Your rights

If you are in the EU, the UK, California or anywhere else with data protection law, you have rights over your personal data — to see it, correct it, delete it, or object to its use.

We will honour any such request, and it is only fair to tell you in advance what the answer will almost certainly be: unless you have used the optional Google sign-in, we hold nothing about you. There is no account, no cookie, no stored identifier and no record of your visit for us to produce or erase. A request about the fonts or the video player is one for Google, whose data we never receive.

If you have signed in, we hold exactly the name, email and photo Google gave us at sign-in, and nothing else. Email us and we will delete your account and every session tied to it.

Ask anyway if you want it in writing: support@excelback.com.

Changes

If this policy changes, the date at the top of the page changes with it. There is no mailing list to notify, because we do not have your address.

Questions about this page, or anything else on this site: support@excelback.com. It is the only contact route the site has — there is no form here that submits to a server.