Our Promise: Your Data, Your Control
At AttendanceSheeter, we believe your data belongs to you—100%, no exceptions. We've built our entire system around privacy-first principles with 24-hour retention for free users, 30-day retention for Sheeter+ registered users, and complete control over your data.
Data Retention Policies
Privacy-first retention: 24 hours for free users, 30 days for Sheeter+ registered users.
Free Users (No Account Required):
All data automatically expires within 24 hours maximum with complete cleanup:
- Attendee data: 24-hour automatic expiration
- Sheet metadata: 24-hour automatic expiration
- Session tokens: 24-hour automatic expiration
- Encrypted data: Complete automatic cleanup
Sheeter+ Registered Users:
Enhanced retention for registered accounts with full control:
- Account profile: Persistent until account deletion
- Attendance sheets: Saved and manageable for 30 days, then automatically deleted
- Checker checklists: Persistent until manually deleted by user
- User credentials: Secure PBKDF2 encrypted storage
- JWT tokens: Configurable expiration with secure refresh
- Immediate deletion: Available anytime through account settings
User-Controlled Data Management
You have complete control over your data with multiple deletion options:
Free Users:
- "Stop Attendance" button: Immediately deletes all event data
- "Delete Sheet" button: Permanently removes sheet and all associated data
- Browser close: Automatic cleanup when you close the browser tab
- Individual attendee deletion: Remove specific attendees from your sheet
Registered Users (Additional Controls):
- Account deletion: Complete removal of profile, sheets, checklists, and attendance records
- Data export: Download all your data in structured JSON format before deletion
- Username management: Change your username with real-time availability checking
- Password changes: Update your password with current password verification
- Session management: Logout from all devices with token invalidation
- Checklist management: Individual checklist and item deletion controls
Comprehensive Security & Encryption
Multi-layered security protecting all data types:
Attendance Data Encryption:
- Hybrid Encryption: RSA-OAEP + AES-GCM encryption
- Unique Keys: Each sheet gets its own cryptographic key pair
- Secure Transmission: All data encrypted before leaving your device
- No Plaintext Storage: Data is encrypted at rest and in transit
Registered User Security:
- PBKDF2 Password Hashing: 100,000 iterations with unique salts
- JWT Authentication: Secure token-based sessions with expiration
- Password Verification: Current password required for sensitive operations
- Session Invalidation: Secure logout with token blacklisting
- Legacy Support: Backward compatibility with secure upgrade paths
- Biometric Protection: Digital signatures handled with privacy-first approach
Data Export & Portability
Comprehensive data export options respecting privacy and security:
Attendance Sheet Exports (All Users):
- PDF Export: Complete attendance records with signatures for verification
- Excel Export: Data-only format excluding signatures for enhanced security
- Privacy Protection: Signatures excluded from Excel exports to protect biometric data
- No Cloud Storage: Export files generated locally and downloaded directly
Account Data Export (Registered Users Only):
- Comprehensive JSON Export: Complete account data in structured format
- Profile Information: User details, creation dates, and account metadata
- Sheeter+ Sheets: All saved attendance sheets with metadata
- Checker Data: Complete checklists with items and progress
- Attendance Records: All attendee data with privacy-safe metadata
- Biometric Protection: Signature data excluded; only capture status included
- Export Metadata: Timestamps, versions, and user information for verification
Configurable Data Collection
You have complete control over what data is collected:
- Optional Signatures: Can be enabled/disabled and required/optional per sheet
- Custom Fields: Email, phone, position, organization - all optional
- Timestamp Control: Choose whether to include submission timestamps
- Field Requirements: Set any field as required or optional independently
What We DON'T Do
- Store free user data beyond 24 hours
- Automatically delete Checker checklists (they persist until you delete them)
- Keep attendance data beyond 30 days for registered users
- Export biometric data (signatures) in any downloadable format except PDFs
- Sell or share your information with anyone
- Track your personal activities or build profiles
- Access your data after it's encrypted
- Store passwords in plaintext (always PBKDF2 hashed)
- Share usernames or account information across users
Anonymous Analytics
We use minimal, anonymous tracking to improve our service:
- Google Analytics: Anonymous usage statistics only
- Performance Monitoring: Error tracking and performance metrics
- No Personal Data: Analytics never include attendee information
- Opt-Out Available: Use browser settings to disable tracking
GDPR & Privacy Law Compliance
Our 24-hour data retention policy exceeds requirements of major privacy laws:
- GDPR Compliance: Right to erasure, data minimization, consent
- CCPA/CPRA Compliance: No sale of personal data, transparent practices
- Data Minimization: Only collect what's necessary for attendance tracking
- Consent Management: Clear opt-in for all data collection
- Right to Deletion: Immediate deletion available at any time
Event Organizer Responsibilities
Shared Responsibility Model: Technology + Event Management
Like traditional in-person attendance sheets or printed sign-up forms, AttendanceSheeter is a tool that facilitates data collection. The event organizer or activity ownerremains the data controller and is responsible for:
- Determining what personal information to collect from attendees
- Ensuring compliance with local privacy laws and regulations
- Obtaining proper consent for data collection at their events
- Providing attendees with information about how their data will be used
- Handling attendee privacy concerns and data requests about their specific event
- Securing and managing exported attendance data from their events
AttendanceSheeter's Role: We provide enterprise-grade security, encryption, automatic data expiration, and privacy-first technology infrastructure. We handle the technical security aspects while event organizers manage their event-specific data practices.
Your Rights
All users have the right to:
- Know what data we collect (detailed in this policy)
- Request immediate deletion of your data
- Control what data is collected through sheet configuration
- Opt-out of analytics tracking
- Export attendance data in PDF and Excel formats
Additional rights for registered users:
- Export all account data in comprehensive JSON format
- Delete your entire account with cascading data removal
- Change your username with availability verification
- Update your password with secure verification
- Access detailed information about what data is exported/deleted
- Control biometric data inclusion in exports (PDFs only)
- Manage checklist data independently
Security Measures
- SSL/TLS Encryption: All data transmitted over secure connections
- Bot Protection: Cloudflare Turnstile prevents automated attacks
- Rate Limiting: Protection against abuse and spam
- Security Headers: Comprehensive security headers implemented
- CORS Protection: Restricted cross-origin access
- Content Security Policy: Protection against XSS attacks
Policy Updates
We'll update this policy if our privacy practices change, always with advance notice and clear explanations of what's changed. Check this page periodically for updates.
Contact Us
Questions about our privacy practices? We'd love to hear from you:
Bottom Line: Your data is yours. We're just here to make attendance tracking simple, secure, and stress-free.
Privacy-first technology, built with respect and transparency.