Data Processing

Crosstabs is built around a local-first analysis flow. This page documents what is processed locally and what can leave the browser.

Local workflow

Uploaded files are parsed in the browser into rows and variable metadata.
Crosstab computation, filters, weighting, recodes, statistics, charts, and exports are produced from browser state.
Saved projects use versioned browser IndexedDB when available, with localStorage as a compatibility fallback. Saved analysis templates use localStorage on the same device and browser profile.
A saved project includes the parsed source rows and current analysis settings so it can be reopened after a reload. It is not uploaded or synchronized to another device.

When a user creates a result link, Crosstabs encodes aggregate counts, row and column labels, and the context the user selected into the URL fragment after #.
The source file and respondent-level rows remain in the creator's browser; they are not placed in the link or uploaded by the share-link workflow.
A recipient's browser decodes the fragment locally. The HTTP request fetches the generic Crosstabs page without the fragment, and browsers omit fragments from HTTP referrer headers.
Crosstabs does not retain the fragment on a server. Anyone with the complete link can read the included aggregates and context, and the link has no account permissions, expiration, or revocation control.

Browser-local Gemma uses the configured model URL after explicit user confirmation and a WebGPU-capable browser.
Server AI is opt-in from the AI panel and receives a structured crosstab summary, not the original spreadsheet file.
The server AI path should be disabled or replaced before analyzing regulated data that cannot be sent to the configured provider.

Production Web Analytics receives redacted page paths, referring origins, and coarse product events. Query strings and URL fragments are removed before sending, /s aggregate snapshot routes are excluded, and a strict-origin referrer policy prevents same-site paths and queries from being forwarded as referrer data.
A sessionStorage funnel record contains only a coarse acquisition surface, upload-or-sample input, and started, ready, or completed stage. It contains no visitor id or user-supplied label and is not synchronized between tabs or devices.
Activation properties never include filenames, project identifiers, spreadsheet cells or rows, variable and category labels, filter values, AI text, or aggregate share fragments.
Vercel processes the analytics request and aggregate reporting data under its current Web Analytics privacy and retention terms.

PDF and XLSX reports include audit metadata such as source file name, filters, weight variable, missing-value setting, report title, analyst, and generated timestamp.
CSV exports sanitize spreadsheet formula prefixes to reduce spreadsheet-injection risk.
Crosstabs does not currently provide account-level retention controls because the public app has no account system. Aggregate share links are not server-stored and cannot be expired or revoked.
Local projects can be removed from the home page or workspace. Clearing Crosstabs site data in the browser removes local projects and templates.