Privacy policy

In short

Cistus keeps your sheets on our servers so they sync between your devices and the people you share them with. It keeps your email to sign you in, and counts how the app and this website are used without anything you type. We don’t sell your information and there are no ads.

What Cistus keeps

• Account: your email address, the name and username you choose, and your picture if you add one. People in a sheet with you see your name, username and picture.
• Settings: your currency, units, number format, appearance, accent colour and whether you get notified about edits.
• Sign-in: we email you a 6-digit code. We keep only a scrambled copy of it. It works for 10 minutes, and we delete it once it’s used or within the hour after it stops working.
• Devices: each device you’re signed in on: its name, whether it’s a Mac, iPhone or Android, the app’s version, and when it signed in and was last used, so Settings can list them. Also a notification token if you allow notifications.
• Sheets: each sheet’s title and text, its earlier versions for Version history, a copy for Search, your tags, the people in it and what each can do, and its share links.
• App usage: a few moments of using the app, such as opening it and making an account, with your account’s ID, your device’s operating system and the app’s version, and your IP address with the approximate location it points to, such as your city. Never your device’s name or anything in a sheet.

What Cistus never keeps

• Answers, totals, balances and who owes whom: your device works them out from the text.
• Where other people’s cursors are and who is typing: these pass between devices and aren’t saved.
• Passwords: there are none. Face ID and your device’s passcode for locked sheets stay on your device.
• Your contacts: sheets are shared by link only.
• A sheet’s text anywhere but the sheet itself, its versions and its search copy: not in logs, usage data or notifications.

Sharing a sheet

Anyone with a sheet’s link can join it once they sign in, and can see and edit it as the link allows. Opening a link in a browser shows the sheet’s title, its owner’s name and picture and how many people are in it, never its text. The owner can stop sharing at any time, which turns the link off.

A notification about an edit carries the sheet’s title and the name of who edited it, never a line of the sheet.

On this website

We count visits: the pages you see, which link brought you here, information about your browser and device, and your IP address with its approximate location. We count them without cookies or anything else saved on your device. The pages of share links aren’t counted. Lines you type into the sheet on the home page stay in your browser and are gone when you leave.

How we use it

To sign you in, keep your sheets in sync and shared with the people you choose, send notifications you allow, prevent abuse, find and fix problems, and see how people find and use Cistus and this website so we can improve them.

Who we share it with

We use these providers to run Cistus: Cloudflare (hosting, data storage and sending sign-in emails), and Apple and Google (notifications). Their servers may be outside your country, including in the United States. We don’t sell your information. We may disclose information when the law requires it.

How long we keep it

Your account, settings and sheets stay until you delete them. A sheet you delete stays in your Trash for 30 days, then it and its versions are deleted. Versions older than 30 days are thinned to one a day, and older than a year to one a month. A device you remove or sign out of is forgotten with its notification token. Usage and website visit data are kept without your name or email, for as long as they help us understand and improve Cistus.

Your choices

• Delete your account in the app’s Settings. Your sheets that no one else is in are deleted with their versions. A sheet you share with others stays theirs: it passes to the person who joined it first. Your picture, devices, tags and settings are deleted.
• Notifications: turn edit notifications off in Settings, or in your device’s settings.
• Access or correct your data: your profile is in Settings. For anything else, email us.

Depending on where you live, you may have other rights over your data. Email us to use them. You can also complain to your local privacy authority, which in Canada is the Office of the Privacy Commissioner.

Children

Cistus is not meant for children under 13. If you believe a child under 13 has given us personal information, email us and we’ll delete it.

Contact

Questions about privacy: support@essentials.tolo.app. We may update this policy; the date at the top shows when it last changed.