Your spreadsheet contents stay in your browser.

MatchDock's public host serves the application you use in your browser. Like any hosted website, the selected production host may process ordinary request information needed to deliver and secure the site, such as the requested path, IP address, user agent, and security logs. Spreadsheet contents are not included in those requests.

MatchDock uses Umami Cloud as its analytics provider. The integration is enabled explicitly at build time and remains disabled when that configuration is absent.

When enabled, Umami records a pageview for the initial page load and for client-side route navigation. MatchDock excludes query strings and hashes. Umami receives ordinary web measurement context such as the page path, referrer, browser, device, screen size, language, and approximate country. Umami forms anonymous sessions from request information without MatchDock setting a cookie or persistent identifier.

MatchDock also sends only the approved custom funnel event name and flow kind. Custom events represent real product actions rather than page views. MatchDock does not define click-tracking attributes, enable performance tracking, use heatmaps or replay, call identify, set a distinct ID, or save session properties. The typed analytics event contract rejects filenames, sheet names, columns, keys, values, rows, counts, file types, formats, and other metadata derived from uploaded documents before an event reaches the provider adapter. Users whose browsers send Do Not Track or block the Umami tracker may not appear in these measurements.

To enforce the current account session, MatchDock checks the verified Clerk session and stores one account-linked record with its SHA-256 identifier hash, provider creation time and closed state. This record contains no raw session identifier, JWT, IP address, location, device history or spreadsheet data. The record has no inactivity expiry: retaining the latest session prevents an older session from regaining access after logout. A newer sign-in replaces the record; account deletion removes it. Clerk may revoke previous sessions. Cloudflare recovery copies follow its retention policy. Session records are not sent to analytics.

Saved workflows store configuration, never spreadsheet contents. When you explicitly save a workflow, MatchDock sends only the workflow name, selected sheet names, header positions, column headers, mappings, key definitions, normalizations, comparison fields, tolerances, and the workflow schema version to the account control plane. This limited exception is necessary to reuse the configuration and detect schema drift.

On pages with state-aware account and Pro actions, the Clerk browser identity SDK may load to determine whether you are signed in. An anonymous session does not request an entitlement from the account control plane or load Paddle checkout. Clerk processes account identity and verification sessions. Paddle acts as the Merchant of Record for Pro checkout, billing, tax, invoices, refunds, and the customer portal. Cloudflare serves and protects the site and hosts the account control plane and its EU-jurisdiction database. Only that control plane receives the saved workflow configuration described above; Clerk, Paddle, and Umami do not. Umami receives only approved, privacy-filtered website and funnel measurements. MatchDock does not send any of these providers spreadsheet files, filenames, rows, cell values, previews, results, or document-derived execution metadata outside the saved workflow configuration described above.