Privacy Policy & Security Architecture
Last updated: October 10, 2026 • Version 1.0.0
The Plain-Language Privacy Promise
When you upload a spreadsheet to OpenMIS, your data never leaves your computer. OpenMIS does not have a backend database for spreadsheet ingestion, does not transmit cell values to third-party APIs, and does not record your file contents in analytics logs.
1. Where Your Data Is Processed
OpenMIS executes in a client-side sandbox. All file parsing (CSV delimiter detection, Excel workbook sheet unpacking), type inference, data profiling, mathematical aggregations, and Apache ECharts rendering occur inside the memory of your local web browser using HTML5 Web Workers.
You can verify this at any time by opening your browser's Network Developer Tools (F12) while uploading an Excel workbook. You will observe zero outgoing POST or PUT requests containing your file payload.
2. Local Storage and IndexedDB
When you click "Save Report" or enable session persistence, your dataset and report definition schema are saved locally inside your browser's IndexedDB database (openmis-db).
This database is isolated to your local browser origin and is inaccessible to external websites. When you click the "Clear Data" button inside OpenMIS, the application terminates the worker session and deletes the IndexedDB records.
3. Telemetry and Analytics Policy
Per Section 14 of our Product Requirements, OpenMIS does not track or collect:
- Spreadsheet file names or file paths
- Column headers, field names, or schema structures
- Cell text, numerical data, or formula contents
- Report titles, widget configurations, or filter states
- User identity, email addresses, or IP addresses
4. Third-Party Services and AI Disclosures
The core OpenMIS dashboard builder requires no AI service keys (e.g. OpenAI, Anthropic, Google Gemini). All insights (concentration, variance, growth rates) are generated using deterministic mathematical algorithms running directly in JavaScript.
5. Questions & Feedback
If you have questions regarding this privacy policy or our open-source security boundary, visit our public GitHub repository or review our Security Architecture.