Tacksheet Privacy Notice
Version 2026-10-14. Effective October 14, 2026.
1. Who we are
Cody Stevens Studio LLC, a Texas limited liability company ("the Studio", "we", "us"), operates Tacksheet at https://tacksheet.com. This notice explains what personal information Tacksheet collects, why, who receives it, and how long we keep it. It covers customers who hold a Tacksheet account and people who open a shared review link or leave feedback. It does not cover the Studio's separate Postit service.
For privacy requests, email privacy@tacksheet.com. We are contacted by email only.
2. Information we collect
Account information: your verified email address, optional profile and workspace names, product-update preference, your identity provider user ID, workspace and membership records, invitations, sign-in methods, authentication times and sign-in attempts. Local session and invitation tokens are stored as one-way hashes. Renewal also stores encrypted WorkOS refresh credentials and an encrypted successor session token with a key version. MFA setup stores factor and challenge identifiers, not the TOTP secret. Identity-change records use keyed email digests. The email outbox stores template metadata, retry state and delivery times; address overrides and one-time password-reset URLs are encrypted, and reset expiry is recorded. We also record which version of the Beta Terms and this notice you accepted, and when.
Billing information: Stripe customer, subscription, invoice, and charge identifiers; your subscription status and paid-through date; and whether a payment has been refunded or disputed. Stripe collects your payment details directly. Tacksheet does not receive or store your full card number.
Your content: review titles, notes, source labels, categories, the files you upload, file names, media types, sizes, checksums, versions, expiry dates, feedback forms and structured form payloads, free-text feedback, imported Postit feedback, and the linked-agent audit log. Files and feedback can contain personal information about you or others; upload only what you are entitled to share and need to share. We store ordinary shared links as one-way hashes.
API keys and agent credentials: each key's label, permissions, expiry, last-use time, and a one-way hash of the key. Linked agents also have approved coverage, token hashes, pairing state and an audit log. To recover a lost creation response, we keep AES-GCM encrypted retry copies of raw API keys, pairing device tokens and one-time read tokens for up to 15 minutes, bound to the operation and issuer. Pairing itself expires after ten minutes, which can end recovery sooner. Expired copies are no longer recoverable and scheduled cleanup clears them. Ordinary shared-link tokens have no such retry copy.
Feedback from reviewers: the text or structured form payload a reviewer submits, the time, the review version and form it refers to, the version of the Beta Terms and this notice the reviewer accepted and when, and a random browser identifier. Imported Postit feedback retains its original timestamp, version and payload or text, labelled as imported. We do not ask reviewers for their name or email address, but anything a reviewer types is stored and shown to the review owner.
Security and technical information: we use IP addresses to apply rate limits and store rate-limit keys as one-way hashes. Our hosting provider, Cloudflare, processes IP addresses and similar network information to deliver and protect the service. Our application logs record operational events with sensitive values removed; request-by-request application logs are turned off. Cloudflare keeps these logs for a short period set by its platform.
Support messages and feedback: what you send to our email addresses or through Feedback in Tacksheet, including any page and browser details you choose to include, and our replies.
3. Cookies and browser storage
Tacksheet sets only the cookies it needs to work:
- a sign-in cookie that lasts up to five minutes while you sign in;
- a session cookie kept until the earlier of the renewal idle and absolute limits, normally 24 hours since activity and never more than seven days since sign-in. Its local authorization token lasts 15 minutes and is renewed by the server. Without renewal, the cookie lasts 15 minutes;
- on a shared review, a feedback cookie that lasts up to 30 days and is used only for that review link, so a reviewer's submissions can be kept in order.
Tacksheet also keeps a few items in your browser's own storage so the site works as you expect, such as your display preference, whether you dismissed a prompt, and answers you have typed into a reply form but not yet sent. They stay on your device and are not sent to us. Unsent answers are removed when you send them or choose Start over, or after a few days. You can clear this storage in your browser at any time.
Tacksheet does not use advertising or analytics cookies. The WorkOS sign-in pages and Stripe checkout and billing pages may set their own cookies, as described in their privacy notices.
4. How we use information
We use personal information to:
- admit eligible users, sign you in, and keep your workspace separate from others;
- send lifecycle, storage and account-security emails, and product updates only if you opt in;
- store, display, and share your reviews and collect feedback as you instruct;
- process payments, manage subscriptions, and handle refunds and disputes;
- prevent abuse, enforce limits, and keep the service secure;
- respond to support, privacy, and abuse requests;
- comply with law and enforce our terms.
We do not sell personal information, share it for cross-context behavioral advertising, show advertising, or use customer content or feedback to train AI models.
5. Who receives information
The review owner and their tools: feedback on a review is visible to the review owner, and to any API keys or AI tools the owner authorizes to read or export it. What happens to feedback after the owner exports it is up to the owner.
People with a shared link: anyone with a review's shared link can view and download its current files and forward the link.
Service providers that process information for us:
- Cloudflare: hosting, networking and security, our database (Cloudflare D1), file storage in two private Cloudflare R2 buckets, email routing for our @tacksheet.com addresses, and transactional email sending;
- WorkOS: sign-in and identity;
- Stripe: payments, subscriptions, and the billing portal; we give Stripe your verified account email to create and update your billing Customer and send billing notices. Stripe may also use payment information for its own fraud-prevention and legal purposes under its own privacy policy;
- a separate storage provider that holds our encrypted backups.
Legal and safety: we may disclose information if the law requires it, or to protect the rights, property, or safety of our users, the public, or the Studio.
Business transfer: if the Studio's Tacksheet business is sold or reorganized, information may transfer to the new operator, subject to this notice.
6. How long we keep information
Reviews, files, and feedback: until the review expires or is deleted. New sheets are kept until deleted unless you choose an expiry of one to 365 days. Sheets created before 2026-10-04 keep their original expiry until their owner changes it. You can change retention later; shared links may expire separately. When you delete a review, its title, file names, and feedback are removed from our database immediately, and the stored file copies are deleted asynchronously. When a review expires, scheduled cleanup erases the same information. We keep minimal records, such as identifiers, file sizes and checksums, times, and deletion markers, so that deleted content is not restored and storage is counted correctly. These records do not contain titles, file names, file contents, or feedback text.
Unfinished uploads: an upload plan expires after one hour, and its partial files are then deleted by cleanup.
Sessions and sign-in attempts: local session tokens last up to 15 minutes; encrypted WorkOS refresh credentials support renewal for up to seven days with a 24-hour idle limit. Sign-in attempts last up to five minutes. Scheduled cleanup removes expired records.
Rate-limit records: deleted about an hour after their time window closes.
Your account: while your account exists, including the non-payment retention and 30-day self-deletion cooling-off windows in the Terms. When your account is erased, your sessions, API keys and linked agents are revoked, your subscription is cancelled, and your reviews, files, feedback and the other content and settings you created are erased by scheduled cleanup. We keep minimal account identifiers and revocation records so that a deleted account and its content are not reactivated or restored.
Acceptance and minimal security records: while the beta runs, and afterwards for as long as needed to show what was agreed, protect the service, or meet legal obligations. At account erasure we delete invitations for the account email, delete identity-change records and clear our billing email digest. Transactional email payloads and encrypted recipients are cleared when sent or abandoned. Failed notices are abandoned after eight attempts or seven days, immediately for permanent errors, and reset notices when the link expires. Sent and abandoned rows are pruned after seven days. A final account-erasure notice can briefly retain the encrypted destination under these same bounds.
Billing records: Stripe identifiers and statuses are kept for as long as needed for accounting, tax, refund, dispute, and legal purposes. Our records of individual Stripe notifications are deleted 7 days after they are processed, or 30 days after processing fails. Stripe retains its own Customer record, including email and payment history, according to its retention policy and legal obligations; deleting a Tacksheet account does not delete that Stripe record.
Support and abuse emails and feedback: for as long as needed to handle the request and keep a record of what we did.
Backups: we make encrypted backups with a separate storage provider. Deleted content can remain in a backup until that backup expires on its retention schedule, for up to about 12 months. If we ever restore from a backup, we reapply the deletions and revocations we have on record before reopening access.
We cannot delete copies that others have already downloaded, exported, or forwarded.
7. Security
We use access controls that keep each workspace separate, private storage buckets, one-way hashes to authenticate keys, links and session tokens, and AES-GCM encrypted retry copies of newly issued API keys, pairing device tokens and one-time read tokens that are recoverable for up to 15 minutes. We also use encrypted session-renewal credentials, isolated sandboxed previews with scripts permitted only for interactive sheets and network connections blocked, and encrypted backups. No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization.
8. Your choices and requests
You can view, export, and delete your reviews in Tacksheet at any time before they expire. Use Account to request deletion with a 30-day cooling-off period, or email support@tacksheet.com.
To ask for a copy of your personal information, or to correct or delete it, email privacy@tacksheet.com. We aim to respond within 30 days. We will ask you to confirm your identity in a proportionate way, usually by replying from the email address on your account. Do not send government ID documents or passwords.
If you left feedback on someone's review, we do not know who you are. To ask about your feedback, email privacy@tacksheet.com with the review title, the approximate time you sent it, and its text. We may need to involve the review owner. We cannot recall feedback the owner has already exported.
You may have additional rights under the law where you live. We will honor them as the law requires.
9. Sensitive information and children
Tacksheet is for adults. It is not intended for anyone under 18, and we do not knowingly collect personal information from children. Do not upload health information, payment card data, government identification numbers or documents, personal information about children, or other regulated sensitive data. If you believe such information has been uploaded, email privacy@tacksheet.com and we will remove it.
10. Where information is processed
The Studio is based in the United States. Tacksheet is intended for users in the United States. Our service providers may process information in the United States and in other countries where they operate.
11. Changes to this notice
Each version of this notice has a date. If we make a material change, we will tell account holders by email or in Tacksheet before it takes effect.
12. Contact
- privacy requests: privacy@tacksheet.com
- account, billing, and account deletion: support@tacksheet.com
- abuse and infringement: abuse@tacksheet.com