Skip to main content

Privacy Policy

Version: 2026-06-24

The short version​

  • Your datasets never leave your device. The statistics engine runs locally, and we do not receive, upload, or store your data, results, or scripts. This is enforced in code, not just promised.
  • We collect only what we need to run accounts and the AI assistant: your account identity (your email, plus your name and avatar if you sign in with Google), your AI usage counters, and some usage and diagnostic information about how the app behaves. We never collect your data.
  • We do not sell your data, and we do not use your data or your prompts to train AI models.
  • You have the usual GDPR rights (access, correction, deletion, objection, and portability). Section 9 explains how to use them.

1. Who controls your data​

The data controller is Statios, operated from Portugal. For privacy matters, write to privacy@statios.ai.

2. Where your data lives​

The Statios statistics engine runs in your browser (as WebAssembly) or on your machine (in the desktop build). Your dataset is loaded, analysed, and saved locally, in your browser's OPFS storage or your operating system's config directory. We do not upload, collect, or keep your datasets, results, scripts, or sessions. This holds even though an account is required to open the app, because the analysis itself happens entirely on your device.

3. The AI assistant, and what the relay does and does not receive​

The built-in Statios AI assistant is server-mediated. There is no "bring your own key" and no model picker. When you use it, your request travels over an encrypted connection to the Statios relay (our service), which calls the model provider for you. The relay receives only two things: your prompt or question, and schema and aggregate context, meaning variable names, types, measurement levels, missing-value counts, and short summaries of computed results.

It never receives your raw dataset rows. That is enforced in code: the relay checks every request and rejects anything that looks like raw tabular data, so the "schema and results, never your rows" rule holds on the server side too. When the relay rejects or logs a request, it records only the field name and the reason, never the content. The relay sends requests to Anthropic (Claude) as our sub-processor. We do not sell your data, and we do not use your prompts to train models.

4. Account data​

If you create an account (through Firebase Authentication) we store only what we need to run it: your account identifier and email (and, for Google sign-in, the name and avatar that Google provides), your plan or tier, your AI usage counters (the credits used in the current window, for quota and billing), and a record that you accepted these terms (the version and a timestamp, see section 6). We do not store your datasets or analysis results against your account.

5. Usage and diagnostic data​

To run, secure, debug, and improve the service, Statios records technical events about how the application behaves while you use it. In concrete terms, this is:

  • what happened, for example a dataset was imported, the engine started or recovered, a statistical test ran, an AI step succeeded or failed, or a guided step moved from one stage to the next;
  • safe descriptive details, such as counts (how many rows or columns), how long something took in milliseconds, the type of operation or analysis (a method name like t-test), route names, and error codes or classes;
  • basic session and technical context, such as a pseudonymous session identifier, your account identifier, the app version, and the coarse device and browser information needed to keep you signed in.

What it never contains. It does not include your datasets, individual cell values, variable values, computed results, file contents, file names, or the text of your AI prompts or answers. By design these events can only carry the simple values listed above, and this is enforced both in the app and, decisively, by an allow-list on the relay that drops anything else.

Why we collect it (the lawful basis). We rely on legitimate interests, under GDPR Article 6(1)(f), to operate, secure, debug, and improve Statios and to understand which features people use. We have weighed this against your interests: the information is metadata only and pseudonymous, you would reasonably expect a product to measure how it runs, and none of it involves special-category data or your datasets. We can share our balancing assessment on request.

Why it is not optional. This information is necessary for us to provide, secure, and maintain Statios to a reasonable standard, so it is not something we switch off per person. Because using Statios requires an account, it is disclosed in, and accepted through, the Terms of Use, which you have to accept to use Statios at all. You keep the GDPR right to object (section 9), but since the information is needed to run the service, objecting may mean we can no longer offer Statios to you. If you would rather it was not collected, the option open to you is not to use Statios.

We have framed this as legitimate interest, disclosed in and accepted through the Terms, rather than as "consent". That is deliberate: under GDPR Article 7(4), consent that is a condition of using a service is not considered freely given.

6. The record that you accepted these terms​

When you create an account or sign in, we record that you accepted the current version of these terms (the version string and a timestamp), so that we can tell you about updates and ask you to re-accept material changes. This is stored only against your account identifier.

7. How long we keep things​

  • Usage and diagnostic data: kept for up to 180 days, then deleted automatically. This window is configurable, and the figure here is the current setting.
  • Account data and usage counters: kept while your account exists, then deleted or anonymised after you close it, subject to any legal duty to keep records.
  • Acceptance records: kept for as long as we need them to show that you accepted.
  • Local data on your device (datasets, sessions, settings): entirely under your control. Clearing your browser site data or deleting the local files removes it.

8. Who else processes data, and international transfers​

We work with a small number of processors under data-processing agreements:

  • Google Firebase and Google Cloud (Firestore, Authentication, Hosting, and Cloud Run) handle account identity, usage counters, acceptance records, telemetry storage, and app hosting. Where it applies, this is hosted in the EU (europe-west1).
  • Anthropic processes AI-assistant requests (the prompt plus schema and aggregate context only, never your data rows), as described in section 3.

Where any of this involves transfers outside the EEA, we rely on appropriate safeguards, such as Standard Contractual Clauses.

9. Your rights​

Subject to the law that applies to you, you have the right to access your personal data, to correct it, to delete it (the "right to be forgotten"), to restrict or object to how we process it (including the legitimate-interest processing in section 5), and to data portability. To use any of these, email privacy@statios.ai, and we will reply within the time the law allows. You can also complain to your supervisory authority; in Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).

10. Cookies and local storage​

Statios uses your browser's local storage for strictly necessary things: keeping you signed in, remembering your settings (theme, panel sizes, recent files), and storing your saved sessions on your device. We do not use advertising or cross-site tracking cookies, so we do not show a cookie banner.

11. Children​

Statios is not meant for children under 16, or under the higher minimum age your national law may set, and we do not knowingly collect their data.

12. Security​

We use industry-standard measures, including encryption in transit (TLS), authentication through Firebase, and least-privilege access to our backend data. No system is ever perfectly secure, but your datasets are simply not part of the attack surface, because they never reach our servers in the first place.

13. Changes to this policy​

We may update this policy. When a change is material we will reflect it in the version and date above and ask you to review and re-accept before you carry on using Statios.

14. Contact​

For a privacy question or request, email privacy@statios.ai. The data controller is Statios, operated from Portugal.