AI privacy
Is My Spreadsheet Sent to AI for Data Cleaning?
AI is used for structured rule suggestions, not file execution. The product builds a narrow request from the deterministic profile, and the optional sample control determines whether any masked example values are included.
By the TidyX team · Updated
What is sent when samples are off
The default request contains dataset-level counts, encoding information, column names, inferred types, missing percentages, unique counts, detected issue summaries, and warnings. It does not contain raw file bytes, storage keys, signed file URLs, user identity, sample rows, or per-column sample values.
The request also includes the context you save, such as the dataset summary, purpose, instructions, domain notes and protected columns, and the data dictionary entries that are not marked sensitive: descriptions, semantic types, roles, units, notes and required or protected flags. Allowed values and missing-value codes stay out of the request. Do not put secrets or unnecessary personal data into those fields. Turning samples off does not exclude your own contextual text.
What changes when you opt in to masked samples
If you turn on the sample option, the request may add existing masked per-column examples and at most five masked rows created by the profiling pipeline. The setting is explicit for each plan generation and remains off by default.
Masking lowers exposure but does not make sample data risk free. You should leave the option off for sensitive datasets unless the additional context is appropriate for your use case.
- Default: profile plus supplied context and dictionary, without samples
- Opt-in: up to five masked rows
- Never: the full uploaded file in the planning request
- Sensitive dictionary columns are excluded from optional samples
Execution happens in a separate deterministic service
After the model returns suggestions, the server validates them against the operation schema and current profile. You review and confirm the plan before a different Worker applies those rules to the file.
Your saved context and dictionary help the planner interpret the profile and respect safeguards. The deterministic engine receives validated confirmed rules for execution, not permission for the model to run arbitrary code.
Frequently asked questions
Does the planning model receive my full spreadsheet?
No. It receives the deterministic profile plus the context and data dictionary you supply. The planning request does not contain the full uploaded file.
Are sample rows shared by default?
No. Samples are off by default. If you opt in, the request may include masked examples and up to five masked rows. Sensitive dictionary columns are excluded from optional samples.
Does turning samples off exclude the context I type?
No. Your supplied context and data dictionary still go to the planner. Avoid putting secrets or unnecessary personal data in those fields.