Share links are bearer links
Recipients can forward a shared link. Turning sharing off stops future use of that link; it cannot remove files someone already downloaded. Replacing the link invalidates the previous one. While a link is on, the sheet’s own address in your browser also leads to it, so you can send either. A one-time read link for an agent works once and ends after 24 hours if unused.
Keep uploaded content separate
HTML previews are sandboxed without scripts. An HTML file you mark interactive runs its scripts in an isolated sandbox: an opaque origin with no network access, no cookies and no access to your account. Replies are collected by Tacksheet’s own page, outside the uploaded document. Replies identify an unverified browser, not a verified person.
Give agents limited access
A linked agent gets only the actions and sheets you approve, and you can narrow or revoke its access at any time. API keys have explicit permissions and a lifetime of up to 365 days, or no expiry until you revoke them. A raw key appears only once.
Know how long things stay
Sheets are kept until you delete them, unless you choose an expiry of 1–365 days. At expiry or deletion, access ends and cleanup removes the sheet’s title, filenames, replies and stored file copies; the stored copies are removed in the background. Minimal deletion records remain for cleanup and recovery.
Closing your account starts a 30-day cooling-off period before erasure. You can export everything from Account at any time.
Beta readiness
Customer admission and payments remain subject to operational readiness. This page describes product behavior, not a compliance certification or service-level guarantee.