Privacy

The short version

Your measurements never leave your browser. There are no accounts, no cookies, no analytics and no third-party scripts of any kind. The only thing this site ever sends to a server is a payment, and only because you clicked a button asking it to.

What happens to the numbers you paste in

They are held in the memory of the browser tab and used to draw the chart. They are not uploaded, not logged and not transmitted anywhere. Closing the tab discards them.

This is an architectural fact rather than a policy: there is no code path that could send them. Every calculation on this site — the control-chart constants, the run rules, the sigma estimators, the ANOVA in a Gage R&R — runs as JavaScript on your own machine. Open your browser’s network panel and chart something: you will see the page load and then nothing at all.

That is also why this site is usable on confidential production data and on work you are contractually barred from uploading to a cloud service.

Payments — the one exception, described exactly

Two small endpoints exist so that a licence can be bought. One creates a Stripe checkout session from the name of the product you chose; the other turns a completed session id into a signed licence key. Neither of them receives a number you have charted — there is no field in either request that could carry one — and there is no database on our side at all.

Card numbers never pass through this site. Checkout happens on Stripe’s own hosted page, and Stripe is the data controller for what you type into it; we see a session id and whether it was paid.

The pricing page additionally asks one of those endpoints, once, whether checkout is open on this deployment. That request carries nothing and happens only on that page.

Hosting is Vercel, which serves the static files and runs those two endpoints. Payment processing is Stripe. Those two are the whole list of third parties.

Your licence key

A licence is a signed line of text stored in this browser’s local storage. It is verified in your browser, using a public key compiled into the page, rather than a call to a server — so licensed and unlicensed visitors are indistinguishable to us, because there is nobody to be distinguishable to.

We keep no copy of any key we have issued. That is deliberate and it has a cost worth stating plainly: we cannot re-send a key we never had. The activation page offers the key as a downloadable file for exactly that reason, and re-opening the activation address re-issues the same key from the Stripe session.

What is stored locally

Three things, all in your own browser and none of them readable by this site’s operator: your light/dark theme preference, a note of whether you have cleared a tool’s sample data during this tab session, and your licence key if you have one. All three are removed by clearing site data — which, for the licence, means pasting the key in again afterwards.

Hosting logs

The site is static files served by a hosting provider, which will see the same request logs any web server sees — an IP address, a URL, a timestamp, a user agent. SPCPlot does not add analytics on top of that and does not receive those logs in any usable form.

Contact

Privacy questions: help@spcplot.com.