Security and your data

Your models stay in your browser

Everything you enter into a model is saved in your web browser, on your own device. We do not store it on our servers, so we do not have a copy.

Because we do not hold your models, we cannot see them, back them up or recover them. If you clear your browser's site data, use another browser or device, or lose the device, the models are gone. Export what you want to keep.

When something leaves your browser

A few features cannot run in your browser. When you use one, the model is sent to our servers for that single request, processed in memory and discarded when the answer comes back. We keep no copy.

• Excel and presentation exports: the model is sent to our server, which builds the file and returns it to your browser. Nothing is retained.
• AI features: the parts of the model the feature needs, which can include a private company's financial statements, are forwarded to OpenAI or Anthropic, depending on how the service is set up. We do not include your email or account identity, and we do not use your data to train any model. The provider handles the data under its own terms. If you do not want your financial data sent to an AI provider, do not use the AI features. Everything else works without them.
• Market data: looking up a listed company sends its ticker symbol, or the company name you typed to find the symbol, to Finnhub, or Yahoo Finance when no Finnhub key is configured. Nothing from your model is sent.

Our hosting provider, Vercel, may keep standard request logs (time, route, status and IP address) for a limited period for security and operations. Those logs do not contain the model.

Your account

Your account is your email address and a password or, where Google sign in is offered, your Google account. It is held by Supabase, our authentication provider. Passwords are handled by Supabase and are never visible to us. If you sign in with Google, we do not store a password for that account.

Signing in sets session cookies that are strictly necessary for the service to know who you are. They contain no tracking identifiers and are not shared with third parties.

To delete your account, email hello@thecel.app from the address on the account. Deleting your account does not delete models from your browser. Clear your browser's site data for the service to do that.

Payments

If you buy a download, Stripe collects your payment details and billing address on its own checkout page. We never see or store your card number.

We keep a record of the purchase: your account identifier, the model's identifier and company name, the amount, the currency, Stripe's payment reference, the payment date and the date the unlock ends. We use it to give you the downloads you paid for and for our accounting.

Payment notifications that Stripe sends us are accepted only with Stripe's signature.

Connections and browser protections

Connections use HTTPS. On every page, the site also sends these instructions to your browser:

• Use HTTPS only for this site, for the next two years.
• Do not guess a file's type, use the type the site declares.
• When you follow a link to another site, pass on only our site name, not the address of the page you were on.
• Do not let another site show this one inside a frame.
• Keep the camera, microphone, location, payment request, USB and ad topics features switched off for this site.

Access and limits

Every request to the service's application interfaces requires a signed in account and is rate limited per account, except the payment notifications Stripe sends us. The limits protect the service and its providers, and requests beyond them are refused.

Page counts, no tracking

We count page views with Vercel Web Analytics. It sets no cookies. Before a page view leaves your browser, Thecel removes anything after a question mark or a hash from the address, and replaces a project's identifier with a placeholder, so which project you open is not counted. The sign in callback is not counted at all.

We show no advertising and load no advertising or tracking scripts.

Your email address

We use your email to sign you in, to send account emails such as confirmation and password reset, and to notify you of material changes to the Service or to these documents. We do not sell it and do not use it for marketing without your consent.

What no page can promise

No system is perfectly secure. Because your models are held in your browser, the security of your own device matters as much as ours.