Privacy Policy

RocketSheets (rocketsheets.io) is operated by CODECAMPUS LLC, 1839 Lake Saint Louis Blvd, Lake Saint Louis, MO 63367, United States, and that company is the controller of the data described here. The list below is short on purpose: a spreadsheet shop needs an email address, a record of what you bought, and very little else. We run no advertising, we build no profiles, and we have never sold anybody’s data.

Card payments are processed by our payment gateway, NMI. You type your card number, its expiry and its security code into secure fields hosted by Evervault, which encrypt them in your browser and pass them on to the processor. They are never seen, handled or stored by RocketSheets.

The name, country and, where the processor asks for it, billing address you enter beside the card go with the payment, straight from your browser to the processor; we do not store them. We give the processor your email address and what you are buying, as part of the payment. Your receipt comes from us, not from the processor. What comes back to us is whether the payment went through. Each of these companies handles that data under its own privacy policy.

• Your email address.
• While a sign-in email is live, a one way hash of the link and of the code inside it, so we can recognise them when they come back. The link and the code themselves are never stored, and each record is erased a day after the email went out.
• Which sheets you own, and which version of each one you hold.
• Your orders, meaning the sheet or bundle, the amount, the currency, the status, and the card processor’s reference for the payment.

Buying needs no account. Check out as a guest and we create one from the email address you gave at checkout, so you can sign back in later and copy again anything you own. There is no password: you sign in with a single use link, or the code beside it, that we email to that address, and the first one arrives as soon as your payment is confirmed. If you mistype the address at checkout the sheet still reaches you straight away, but the account belongs to whatever you typed. Write to [email protected] and we will move it.

Sending us a message stores the name, email address and message you typed, plus one derived value that stands in for your IP address:

• A salted, one way SHA-256 hash of the IP address the request came from. The address itself is never written to our database or our logs, and the hash cannot be turned back into it.
• That hash lets us recognise a repeat sender. Five messages an hour from the same one and the form stops accepting more.
• It is erased 30 days after the message that produced it. Your message stays until we have dealt with it, and the hash beside it goes.

The form is also protected by Cloudflare Turnstile, which is the part that actually stops bots. Turnstile receives your IP address directly and processes it under Cloudflare’s own privacy terms.

Starting a checkout, and opening a card payment, each record the same kind of salted, one way hash of your IP address that the contact form uses, and nothing else. It is how we cap how many checkouts one connection can start in an hour, which keeps automated card testing off the shop. Asking for a sign-in email, and typing a sign-in code, record the same hash for the same reason: to cap how often one connection can try. The address itself is never stored, and each hash is erased after one day.

The only cookies RocketSheets sets are the session cookies that keep you signed in. They are what lets the site recognise you and hand over a sheet you own. There are no advertising cookies, no analytics trackers and nothing that follows you to another site.

Downloading a sheet means being sent to Google’s “make a copy” page, which puts a copy in your own Google Drive. That copy is yours, inside your Google account. RocketSheets has no access to your Drive and cannot read, change or delete anything you keep there, the sheet included.

Account and purchase records live in a database on our own server infrastructure in the United States. Our providers and their infrastructure are US based, so that is where your data is processed.

Beyond that, the list of who touches it is simply the list of what makes the shop work. NMI, our payment gateway, and Evervault, whose secure fields take your card details, for payments. Cloudflare for the anti-spam check on the contact form. Resend, which delivers the sign-in email and therefore handles your address and the link and code inside it. Google, which hosts the sheet templates and the Drive you copy them into. The database itself is ours and no third party runs it. Otherwise we disclose data only where the law compels us to.

Account and order records are kept while you have an account, which is what lets you download a sheet again years later, and afterwards for as long as legal, tax and accounting obligations require.

Contact form hashes are erased after 30 days, and checkout and sign-in hashes after one day, automatically, as described above.

Write to [email protected] from the address on your account to see, correct or delete what we hold. Deleting the account ends your ability to sign in and download again. It has no effect on a sheet already copied into your Google Drive, which stays yours regardless. Where a record has to be kept for tax or accounting, we keep that record and delete the rest.

If what we collect changes, this page changes with it and the effective date at the top moves. Material changes go up here before they take effect.

Anything about your data, answered by a human:

Or by post: CODECAMPUS LLC, 1839 Lake Saint Louis Blvd, Lake Saint Louis, MO 63367, United States.