AttendanceSheeter

Privacy Policy

Your data, your control — always

Our Promise: Your Data, Your Control

At AttendanceSheeter, we believe your data belongs to you—100%, no exceptions. We've built our entire system around privacy-first principles with 24-hour retention for free users, 30-day retention for Sheeter+ registered users, extended retention for active Sheeter Pro subscribers, and complete control over your data.

Data Retention Policies

Privacy-first retention: 24 hours for free users, 30 days for Sheeter+, no auto-delete for active Sheeter Pro subscribers.

Free Users (No Account Required):

All data automatically expires within 24 hours maximum with complete cleanup:

  • Attendee data: 24-hour automatic expiration
  • Sheet metadata: 24-hour automatic expiration
  • Session tokens: 24-hour automatic expiration
  • Encrypted data: Complete automatic cleanup

Sheeter+ Registered Users:

Enhanced retention for registered accounts with full control:

  • Account profile: Persistent until account deletion
  • Attendance sheets: Saved and manageable for 30 days, then automatically deleted
  • Checker checklists: Persistent until manually deleted by user
  • User credentials: Secure password hashing via BetterAuth
  • Sessions: HTTP-only cookie-based sessions with server-side management
  • Immediate deletion: Available anytime through account settings

Sheeter Pro Subscribers:

Extended retention for paid subscribers with full data control:

  • Attendance sheets: No auto-delete while your subscription is active
  • On cancellation: Full access continues until the end of your billing period
  • Post-expiration: 30-day grace period with read-only access to export your data
  • After grace period: Standard Sheeter+ 30-day retention rules apply
  • Inactivity: After 2 years with no login, a warning email is sent with 30 days to respond before data deletion

User-Controlled Data Management

You have complete control over your data with multiple deletion options:

Free Users:

  • "Stop Attendance" button: Immediately deletes all event data
  • "Delete Sheet" button: Permanently removes sheet and all associated data
  • Browser close: Automatic cleanup when you close the browser tab
  • Individual attendee deletion: Remove specific attendees from your sheet

Registered Users (Additional Controls):

  • Account deletion: Complete removal of profile, sheets, checklists, and attendance records
  • Data export: Download all your data in structured JSON format before deletion
  • Username management: Change your username with real-time availability checking
  • Password changes: Update your password with current password verification
  • Session management: Logout from all devices with token invalidation
  • Checklist management: Individual checklist and item deletion controls

Comprehensive Security & Encryption

Multi-layered security protecting all data types:

Attendance Data Encryption:

  • Hybrid Encryption: RSA-OAEP + AES-GCM encryption
  • Unique Keys: Each sheet gets its own cryptographic key pair
  • Secure Transmission: All data encrypted before leaving your device
  • No Plaintext Storage: Data is encrypted at rest and in transit

Sheeter+ At-Rest Encryption:

  • Per-User Encryption Keys: Each user's data encrypted with a unique AES-256 key
  • Encrypted Storage: Attendee PII (name, email, phone, signature, etc.) encrypted before database storage
  • Public Submission Security: QR and kiosk submissions encrypted with per-sheet RSA public keys
  • Tenant Isolation: One user's encryption key cannot decrypt another user's data

Registered User Security:

  • Password Hashing: Secure hashing via BetterAuth before storage
  • Cookie-Based Sessions: Secure HTTP-only cookie sessions with server-side management
  • Password Verification: Current password required for sensitive operations
  • Session Invalidation: Secure logout with session deletion
  • Biometric Protection: Digital signatures handled with privacy-first approach

Data Export & Portability

Comprehensive data export options respecting privacy and security:

Attendance Sheet Exports (All Users):

  • PDF Export: Complete attendance records with signatures for verification
  • Excel Export: Data-only format excluding signatures for enhanced security
  • Privacy Protection: Signatures excluded from Excel exports to protect biometric data
  • No Cloud Storage: Export files generated locally and downloaded directly

Account Data Export (Registered Users Only):

  • Comprehensive JSON Export: Complete account data in structured format
  • Profile Information: User details, creation dates, and account metadata
  • Sheeter+ Sheets: All saved attendance sheets with metadata
  • Checker Data: Complete checklists with items and progress
  • Attendance Records: All attendee data with privacy-safe metadata
  • Biometric Protection: Signature data excluded; only capture status included
  • Export Metadata: Timestamps, versions, and user information for verification

Payment Information (Sheeter Pro)

Sheeter Pro subscriptions are processed by Polar.sh, our Merchant of Record:

  • Payment Processing: Polar.sh collects and processes your name, email, billing address, and payment information
  • No Card Storage: AttendanceSheeter never stores, processes, or has access to your credit card numbers or payment details
  • PCI Compliance: Payment data is handled in accordance with PCI DSS standards by Polar.sh and their payment processor (Stripe)
  • What We Store: Only subscription status, plan type, and billing period dates — no payment details
  • Polar.sh Privacy: For Polar.sh's privacy practices, see their privacy policy

Configurable Data Collection

You have complete control over what data is collected:

  • Optional Signatures: Can be enabled/disabled and required/optional per sheet
  • Custom Fields: Email, phone, position, organization - all optional
  • Timestamp Control: Choose whether to include submission timestamps
  • Field Requirements: Set any field as required or optional independently

What We DON'T Do

  • Store free user data beyond 24 hours
  • Automatically delete Checker checklists (they persist until you delete them)
  • Keep attendance data beyond 30 days for Sheeter+ users (Pro subscribers have extended retention while subscribed)
  • Export biometric data (signatures) in any downloadable format except PDFs
  • Sell or share your information with anyone
  • Track your personal activities or build profiles
  • Access your data after it's encrypted
  • Store passwords in plaintext (always PBKDF2 hashed)
  • Share usernames or account information across users
  • Store, process, or access your credit card numbers or payment details

Anonymous Analytics

We use minimal, anonymous tracking to improve our service:

  • counter.dev: Privacy-friendly, cookie-free analytics — no personal data collected
  • Google AdSense: Ad-supported free tiers; Pro subscribers are ad-free
  • No Personal Data: Analytics never include attendee information
  • Cookie Consent: Cookie consent banner for ad and analytics preferences

GDPR & Privacy Law Compliance

Our 24-hour data retention policy exceeds requirements of major privacy laws:

  • GDPR Compliance: Right to erasure, data minimization, consent
  • CCPA/CPRA Compliance: No sale of personal data, transparent practices
  • Data Minimization: Only collect what's necessary for sign-in collection
  • Consent Management: Clear opt-in for all data collection
  • Right to Deletion: Immediate deletion available at any time

Event Organizer Responsibilities

Shared Responsibility Model: Technology + Event Management

Like traditional in-person attendance sheets or printed sign-up forms, AttendanceSheeter is a tool that facilitates data collection. The event organizer or activity ownerremains the data controller and is responsible for:

  • Determining what personal information to collect from attendees
  • Ensuring compliance with local privacy laws and regulations
  • Obtaining proper consent for data collection at their events
  • Providing attendees with information about how their data will be used
  • Handling attendee privacy concerns and data requests about their specific event
  • Securing and managing exported attendance data from their events

AttendanceSheeter's Role: We provide industry-standard security, encryption, automatic data expiration, and privacy-first technology infrastructure. We handle the technical security aspects while event organizers manage their event-specific data practices.

Your Rights

All users have the right to:

  • Know what data we collect (detailed in this policy)
  • Request immediate deletion of your data
  • Control what data is collected through sheet configuration
  • Opt-out of analytics tracking
  • Export attendance data in PDF and Excel formats

Additional rights for registered users:

  • Export all account data in comprehensive JSON format
  • Delete your entire account with cascading data removal
  • Change your username with availability verification
  • Update your password with secure verification
  • Access detailed information about what data is exported/deleted
  • Control biometric data inclusion in exports (PDFs only)
  • Manage checklist data independently

Security Measures

  • SSL/TLS Encryption: All data transmitted over secure connections
  • Bot Protection: Cloudflare Turnstile prevents automated attacks
  • Rate Limiting: Protection against abuse and spam
  • Security Headers: Comprehensive security headers implemented
  • CORS Protection: Restricted cross-origin access
  • Content Security Policy: Protection against XSS attacks

Policy Updates

We'll update this policy if our privacy practices change, always with advance notice and clear explanations of what's changed. Check this page periodically for updates.

Contact Us

Questions about our privacy practices? We'd love to hear from you:

Contact UsFacebook

Bottom Line: Your data is yours. We're just here to make collecting sign-ins simple, secure, and stress-free.

Privacy-first technology, built with respect and transparency.