Who we are
This service is operated by Trestle Path Analytics Corp., a corporation incorporated under the Canada Business Corporations Act, corporation number 1813547-9, with its registered office in British Columbia, Canada. The corporation is the organization accountable for the personal information described below.
Questions, access requests and deletion requests: info@trestlepath.com.
Your schedules, step by step
A schedule is a confidential project document, so the dashboard is built never to need yours. This is what happens every time you open one.
In plain English · 3 min
How your schedule stays on your computer
A short summary of this section. The written notice below is the full account.
Until you press play, this page does not contact YouTube. Pressing play loads YouTube’s player from youtube-nocookie.com, and YouTube’s own privacy policy then applies (see Cookies and browser storage).
- Your file is read on your computer. The XER or XML file is opened and read by code running in your browser. There is no upload step: the file, and its name, never leave your computer.
- The words stay with you. Activity IDs and names, WBS names, calendar, resource and role names, activity codes, user-defined fields, notes, costs and rates, the project’s name and the file’s name are never sent anywhere.
- Only a coded outline is sent, and only for calculations. For the heavier calculations (such as float paths, delay and comparison analysis, at-completion durations and resource curves) your browser sends our calculation service the numbers they need, with every activity, relationship, calendar and resource replaced by a random code made up in your browser for that one calculation. The same activity gets a different code in every calculation, so nothing can be matched across calculations, reviews or customers.
- The answer comes back in the same codes. Only your browser knows what each code stands for, and it puts the names back. Every page, chart, workbook and PDF is built in your browser and saved straight to your computer.
- Nothing is kept. The service calculates in memory and then discards the outline and the answer: no copy, no database of reviews, nothing written to disk, and no content in any log.
| In your schedule | What happens to it |
|---|---|
| The file itself, and its name | Stays on your computer. Never uploaded. |
| Project names and codes; activity IDs and names; WBS names and codes | Stays on your computer. Never sent. |
| Calendar, resource and role names; activity codes; user-defined fields; notes and descriptions | Stays on your computer. Never sent. |
| Costs, prices, rates, budgets and currency | Stays on your computer. At most a count or a yes/no result is sent (for example, whether the file carries costs at all). |
| Dates, durations, progress and float | Sent for calculation, against random codes. Never stored. |
| Logic: relationship types and lags; activity and constraint types | Sent for calculation, between random codes. Never stored. |
| Calendar working time: hours per day, working days, shifts, non-working dates | Sent for calculation, against a random calendar code and without the calendar’s name. Never stored. |
| Resource quantities (budgeted, actual, remaining) and their timing | Sent for calculation, against random codes and without the resource’s name, unit, rate or cost. Never stored. A resource whose unit is itself money has quantities that are amounts of money, and they travel as the quantities they are. |
See it for yourself. Your schedule stays yours is a worked example with our Vireo Line sample project: one real activity, shown as it sits in the file and exactly as our calculation service received it, and a check of every request a full review sends (PDF, 9 pages).
What the calculation service does keep. For each calculation, one operational line: the time, which kind of calculation it was, its size in bytes, how long it took, whether it succeeded, and a scrambled tag that stands for the account rather than naming it. We use these lines to find faults and to apply fair-use limits. They contain no part of your schedule, and they are deleted after 30 days. Each calculation is tied to your signed-in account so that only licensed users can calculate; what we hold about accounts is set out in the next section.
The licence mark in what you export. Workbooks, letters, PDFs and PowerPoint decks you export from the dashboard carry a short tag such as TP-41a0a1ce1f in the file’s properties (on the issue-ready pack, also on its provenance line). The tag is a one-way digest that stands for your account. It is not your name or your email, the account cannot be worked out from it, and nothing about it is stored, but we can match it to the account if a file is ever passed on outside your licence. Pages you print from the browser carry no tag.
Trestle Path for Excel
Trestle Path for Excel is our add-in for Microsoft Excel (on the web, Windows and Mac). It draws linear schedules in your workbook and comes with the Linear Schedule module. It keeps the promise above: your workbook and any schedule file you open in it are read and drawn on your computer, inside Excel, and are never sent to us. The drawing engine is downloaded from us; your work is not uploaded to it.
- Signing in. You sign in once, in the add-in’s panel, with your Trestle Path email and password (and your authenticator code if you use one). That sign-in is recorded like any other verified sign-in (see What we hold, and why). The panel then receives a random sign-in link that lasts 30 days, kept in Excel’s own browser storage on that computer, so you are not asked for your password every time. We keep only a one-way hash of the link, never the link itself.
- Checking your plan. While the panel is open it asks us every 15 minutes, and when you come back to it, whether your plan still includes the Linear Schedule module. That question carries the sign-in link and nothing about your workbook. It needs a connection: without one the panel stops drawing, and everything already drawn stays as it is.
- The licence mark. When the add-in draws, it writes a short tag such as
TP-3f9a01c2d7into the workbook’s Category property, and “Trestle Path Analytics” into Company if that is empty. The tag is a one-way digest that stands for your account. It is not your name or your email, and the account cannot be worked out from it, but we can match it to the account if a workbook is ever passed on outside your licence. - Ending it. Sign out in the panel deletes the link at once. Sign out everywhere on your account page, or a password change, ends every link at its next check, and deleting the account deletes them all. While an account is on hold, or its plan does not include the Linear Schedule module, the add-in does not draw. An account holds at most ten links; making an eleventh deletes the oldest.
What we hold, and why
Nothing in this table comes from a schedule file. Everything below is about the account and the connection — who signed in, from what kind of browser, and whether that connection is still open. The schedules you load stay on your computer, and none of the records below can tell us anything about them.
| Information | Why we hold it | Kept for |
|---|---|---|
| Name, organization, email address, and (only if you choose to tell us at sign-up) how you heard about us | To identify your account and send you your activation key and service notices; the last item only to learn which of our pages and mentions are useful, in aggregate | Until the account is deleted |
| Password | Stored and verified by Google Firebase Authentication. We never see it. | Until the account is deleted |
| Activation key, licence type, trial end date | To grant and to end access | Until the account is deleted |
| Hashed IP address (one-way, salted; the address itself is never written down) | To distinguish one connection from another, so a shared licence is visible | 90 days |
| City, region and country when available for a recorded sign-in | To spot a single account in use in several places at once | 90 days |
| Browser, operating system, device type | Same purpose, and to diagnose problems | 90 days |
| First and most recent activity for each hashed connection, plus a recorded sign-in count. The latest time may include a later presence update and is not an individual sign-in event. | Same purpose | 90 days |
| A separate event for each verified sign-in: account, email, authentication time, sign-in method and whether a second factor was used. Cookie renewals and presence updates do not create new events. | To distinguish actual sign-ins from later activity when reviewing account access | 90 days; deleted sooner with the account |
| For each Trestle Path for Excel sign-in link: a one-way hash of the link, your account, when it was made and when it ends, when it was last used (to the hour), the time of the sign-in that made it, and a plain label such as “Excel on Windows”. At most ten per account | So the add-in stays signed in without asking for your password each time, and so a link can be ended from your account page | Until the link ends (30 days at most), you sign out in the panel, or the account is deleted, whichever comes first |
| The date of your most recent verified sign-in, shown on the account record | To give account administrators a current sign-in reference alongside last activity | Until the account is deleted |
| The time of your most recent activity, shown on the account record (one time, replaced each time; not a history) | To show administrators whether an account is in use | Until the account is deleted |
| Characteristics of the browser and computer you sign in from — how your browser draws a test image and plays a test sound, your graphics hardware’s name, which of a fixed list of fonts you have, screen size, time zone, languages, platform, processor count, memory size, touch support, and whether the browser reports itself as automated | These are combined into a one-way hash that lets us recognise “the same computer” without knowing whose it is. It is how we tell a licence shared between two people apart from one person using a laptop and a phone | 90 days |
A random identifier stored by your browser (tp_device_id, in your browser’s local storage) | Helps recognise the same browser when the technical characteristics above change, for example after a graphics driver update | Until you clear your browser storage |
| A short note of what was measured — for example your graphics hardware’s name in readable form | So an administrator reviewing a flag can see what it was based on rather than an unexplained score | 90 days |
| A five-minute “still signed in” signal while the tool is open. It is sent by the sign-in system, and it carries only what identifies the connection: your account, the random browser identifier and the hashed network values already described above, a plain label such as “Chrome on Windows”, and the time. There is nothing about your work in it — no file, no file name, no schedule data, nothing you typed or clicked | Two connections answering at the same moment from different networks is the clearest sign of one licence being used by several people. It is a signal about the connection, not about the work: it is produced entirely outside the part of the tool that reads your schedule, so it does not know which file is open and could not report it | Rolling — each signal replaces the last; the current session only |
| The outcome of a sharing or trial-abuse assessment — a level, a score and the reasons in words | So a decision about an account can be explained and reviewed later | Until the account is deleted; cleared sooner if the flag is released |
| If a free trial is held for review (see Automated decisions): your name and email address, the reason in words, and the progress of the review — whether you and the administrator were emailed, who looked at it, and what was decided | So that a person reviews the hold, you are told about it, and the decision can be explained later | Until the account is deleted |
| A one-way hash of your email address, recording that this address has used its free trial | The free trial is one per mailbox. The address itself is never stored — only a hash that can answer that one question | Kept after account deletion (see Your choices) |
| Your subscription: the plan, its add-ons, when it renews, and its billing status (for example active, a payment outstanding, or set to end), with the Paddle references that link it to your account | To give you the access you paid for | Until the account is deleted |
| A log of billing and administrative actions on your account: a plan or billing-cycle change you booked, a refund or chargeback and what was done about it, a cancellation, a licence granted or withdrawn by an administrator. Each entry carries its date and your account’s email address, never card or bank details | Our record of what was charged, changed, refunded or decided and why, which we may need for accounting, tax or a dispute | Seven years after each entry, then deleted automatically, whether or not the account still exists (see Your choices) |
| Each order our website creates when you choose a plan, and each plan or billing-cycle change you book: the plan, modules and billing cycle, the Paddle transaction, and what became of it. If the payment window reports an error, the error and your account’s email address | So that a new subscription is set up only from an order we created, with exactly those items, and a change you booked is made when it should be | Seven years after it was made, then deleted automatically, whether or not the account still exists; one still open is kept until it closes |
| A record of each notification Paddle sends us about a subscription: the Paddle references for the subscription and the customer, the kind of event, when it arrived, and whether we applied it; until it has been applied, also the notification itself, so that it can be tried again (it is removed once applied). Never card or bank details | So that each notification is acted on once and only once, and we can show what Paddle told us about a subscription, and when | Until it has been applied and seven years have passed since it arrived, then deleted automatically, whether or not the account still exists |
| A billing matter set aside for a person: a payment we held because it was not made through our website, was for a combination we do not sell, or was a second subscription for an account that already has one, or another billing event that needs checking. It carries the Paddle references, the email address of the account it concerns, what happened, and how it was settled | So that a person refunds the payment, sets it up or puts it right, and what was decided can be accounted for later | Until it has been settled, then seven years more, then deleted automatically, whether or not the account still exists |
| A payment we could not match to any account: the Paddle references for the subscription and the customer, and when it arrived | So that it can be linked to the right account, or refunded | Until it has been resolved and seven years have passed since it arrived, then deleted automatically |
| Invoices, receipts and payment records for orders through our website checkout | We do not hold these. Paddle does, as the merchant of record, under its own privacy notice and tax obligations | Set by Paddle |
| Invoices for licences we bill directly, and their payment records | To meet our tax and accounting obligations | As long as tax law requires (in Canada, generally six years after the end of the tax year they relate to) |
| A record of each calculation: its time, kind, size in bytes, duration and outcome, with a scrambled tag standing for the account. Never any part of a schedule | To find faults and apply fair-use limits to the calculation service | 30 days |
| Messages sent through the contact form | To answer you | Until deleted by us |
| Visit statistics, only if you allow them — which public pages were viewed, the page or site you came from, the type of device and browser, and an approximate location (city or region), recorded by Google Analytics against a random identifier in a cookie. Google Analytics does not keep IP addresses, and we do not link these statistics to your account | To learn which pages are useful and where visitors come from | 2 months |
What we do not do
- We do not store raw IP addresses, and the hashes we do store cannot be converted back into an address — not by you, not by us, and not by anyone who obtained a copy of the database. The same is true of the device characteristics, with one exception we would rather name than gloss: a short readable note of what was measured, such as your graphics hardware’s name, is kept alongside the hash so that a flagged account can be explained to a person.
- We do not use advertising tags, tracking pixels or cross-site tracking, and there is no advertising on this site. The one analytics tool, Google Analytics, counts visits to the public pages only if you allow it in the cookie notice; it is off until you do, never runs on the payment, account or dashboard pages, and is not used for advertising. There are things your browser does store, and some of them are set by Google or, where you pay, by Paddle — all of it is listed under Cookies and browser storage below.
- We do not sell, rent or share personal information with third parties for their own purposes.
- We never receive, retain or read the schedule files you analyse. Every schedule you open is parsed by code running inside your own browser, and the file is never sent to us. To calculate a review, your browser sends our calculation service only the numbers the review needs (dates, durations, logic and lags, calendar working times, progress, float settings and resource quantities); they are held in memory while the review is calculated, then discarded — never stored, never logged. Names, descriptions, codes, notes, costs, file names and project names are never sent; everything that is sent goes under random codes made up in your browser for that one calculation (see Your schedules, step by step). The calculation service runs on Google Cloud in the United States. Every other record described in this notice sits outside your schedule: activity ends, licences get checked, sessions get counted — your schedule is not in any of it.
Why we record sign-in locations
Access is licensed per person. Recording the approximate location, the technical characteristics of the browser, and whether a session is still open lets us see when one set of credentials is being used by several people in several places — which is the one thing that undermines a per-person licence. All of these are properties of the connection. None of them is derived from, or reveals anything about, the schedules you analyse.
It is used for that purpose and no other. We never look at which schedules you open, which pages you use or what your analysis says — none of that reaches us in the first place. We do not use any of it to assess how hard or how long you work, and no one is managed or appraised on it.
To be exact about what that five-minute signal can and cannot show. It can show that an account had the tool open at a given time, from a connection we can distinguish from another connection. That much is unavoidable if simultaneous use is to be detectable at all. It cannot show anything about the schedule you had open — not its name, not its size, not a single activity in it — because your schedule is read by code running on your own machine and is never transmitted. The signal knows that a session is alive; it does not know what the session is doing. And the timing fact itself is used only for the purpose above: it is not retained as a history of your working hours.
Where a pattern looks like a shared licence, a person reviews it and contacts you before anything is done to the account. The one exception is a free trial, which software can place on hold on its own — explained next.
Automated decisions
One judgement about you on this service is made by software without a person involved: a free trial can be placed on hold where the signals above suggest the same person is opening repeated trials. When that happens the trial is paused and the account returns to a waiting state.
What this is not: it is not a refusal, nothing is deleted, and it never applies to an account that has paid. We queue an email when the hold is placed and retry delivery if our mail service is temporarily unavailable. An administrator reviews the hold, and a single click restores the trial. If you believe a hold is wrong, reply to that email or write to info@trestlepath.com and a person — not software — will look at it and tell you the outcome.
Three billing events also end a paid subscription automatically. None of them is a judgement about you; each is a fact about a payment: a chargeback on a payment for the subscription, a full refund of the payment that started it, and a renewal that cannot be collected once Paddle’s retries have ended. If a chargeback is later resolved in our favour, write to us and we can restore your access. Any other refund is handled by a person, and the rest of the subscription carries on (see the refund policy).
Every other consequence on this service, including any suspension of a paid licence, requires a person to decide it.
Cookies and browser storage
The complete list. There is no advertising on this site, no pixel and no ad tag. One item measures visits, and only if you allow it: Google Analytics, which is off until you choose “Allow statistics” in the cookie notice. Everything else is here to run the service, and three items come from other companies — Google’s bot check, Google Analytics if you allow it, and, on the pages where you can pay, Paddle’s checkout — so we name them.
| What | Set by | What it is for | How long |
|---|---|---|---|
__session — a cookie | Us | Set only when you sign in. It is how our server confirms you may open the dashboard. It carries nothing about your work and cannot be read by scripts on the page. | Up to 5 days, or until you sign out |
| A Google reCAPTCHA cookie, on Google’s own domain | Part of the invisible bot check described below. It is what lets Google score the request. We never see it. | Set by Google; see their privacy policy | |
| Paddle’s checkout script, and the payment window it opens | Paddle | Paddle is our merchant of record. Its script loads on the payment page and the account page, so that a checkout or a card update can open there, and the payment window is Paddle’s own. When you open a checkout, Paddle may set its own cookies and browser storage to take the payment securely. We do not see or control them. | Set by Paddle; see Paddle’s privacy notice |
tp_session_hint — browser storage | Us | Remembers that you are signed in so the page header paints correctly instead of flashing “Sign in” for a moment. Decides nothing. | Until you sign out or clear browser storage |
tp_device_id — browser storage | Us | The random identifier described in the table above, used to recognise the same browser for licence-sharing checks. | Until you clear browser storage |
tp-site-activity — browser storage | Us | The time you last used a signed-in page, as a single number replaced as you work. It lets an administrator's console, which signs itself out after an hour without activity, tell that you are still working in another tab. It is never sent to us. | Until you clear browser storage |
tp.excel.link.v1 — Excel’s browser storage | Us | Only if you use Trestle Path for Excel: the add-in’s 30-day sign-in link, described above, and when it ends. It is sent only to trestlepath.com, to check your plan. | Until the link ends, you sign out in the panel, or you clear Excel’s storage |
| Page preferences — browser storage | Us | Things you set inside the tool: a chosen report layout, an open panel, a theme. They stay in your browser and are never sent to us. | Until you clear browser storage |
_ga and _ga_SSFLGVKLS3 — cookies, optional | Google Analytics, for us | Set only if you choose “Allow statistics”. A random identifier that lets Google Analytics count a return visit as the same visitor. It carries nothing about your work, is not linked to your account, and is not used for advertising (Google signals and ad personalisation are off). Not set on the payment, account or dashboard pages. Switching statistics off in “Cookie choices” deletes it. | Up to 60 days after your last visit; the statistics themselves are kept 2 months |
| tp_notice — browser storage | Us | Remembers your answer in the cookie notice (statistics allowed or not) so it is not asked on every page. It is never sent to us. | Until you change it or clear browser storage |
Visit statistics are the one optional item. They are off until you allow them, “Necessary only” is as easy as “Allow”, and “Cookie choices” at the foot of every public page lets you change your mind at any time. Everything else cannot be switched off, and we do not pretend otherwise. The sign-in cookie is what releases the product to you; the bot check is what keeps automated sign-ups and shared licences off a service sold per seat; and Paddle’s checkout is how a payment is taken. If you would rather not have any of those, the honest answer is not to sign in — and you can still read every page on this site.
Videos on the guide pages and on this notice. Some guides show a tutorial from our YouTube channel, and this notice shows a short summary video. Until you press play, the page shows a still picture kept on this site, and your browser does not contact YouTube. Pressing play loads YouTube’s player from youtube-nocookie.com; from then on YouTube (Google) handles the video under its own privacy policy, and it may store items in your browser while it plays. The chapter links also open the video on youtube.com directly, if you prefer.
Bot and abuse checks
Two third-party checks run on this site to keep automated sign-ups and scripted access out.
- Cloudflare Turnstile runs on the registration form, and on the contact form on our home page. It is fetched only once you start filling one of those in — if you never do, your browser never contacts Cloudflare. You may see a box to tick, or nothing at all.
- Google reCAPTCHA runs invisibly on the sign-in, password reset and payment pages, and on the home and pricing pages only once you use the contact form or are already signed in (never on this notice, the terms or the refund policy), to confirm requests come from a real browser on trestlepath.com rather than from a script written against our API. It shows no puzzle and asks you nothing. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Both providers receive technical information about the request in order to score it. Neither is used to build a profile of you for us, and we receive only the outcome.
Payments
Our order process is conducted by our online reseller Paddle.com, which is the merchant of record for all orders placed through our website checkout (Paddle.com Inc. for buyers in the United States, Paddle.com (Canada) Ltd for buyers in Canada, and Paddle.com Market Limited elsewhere, as set out in Paddle's Checkout Buyer Terms). Your card details are entered on Paddle's systems and are never seen, transmitted or stored by us. We receive from Paddle only what we need to run your subscription: its status, what it includes, when it renews, and word of a payment that fails, is refunded or is charged back. Paddle's handling of your payment information is governed by its own privacy notice.
A licence we invoice directly is billed by us, not by Paddle, and its invoice is kept as described under What we hold, and why.
Who can see it
Only administrators of Trestle Path Analytics. Access to the console is restricted by server-side security rules, not merely hidden in the interface, and every administrative action is written to an audit log whose entries cannot be edited; each entry is deleted automatically seven years after it was made.
Where it is held
Your data is stored and processed in the United States. Account data is held in Google Cloud Firestore and Google Firebase Authentication in Google’s United States multi-region, and our server code runs in Google’s us-central1 region (Iowa). We are a Canadian corporation and remain accountable for it under Canadian law wherever it is held; it is subject to the laws of the country it is stored in, including lawful access requests there. If you are procuring on behalf of a public body and need this addressed formally, write to us and we will answer in writing.
The organisations that process personal information on our behalf are:
| Who | What they do for us |
|---|---|
| Google (Firebase / Google Cloud) | Accounts, sign-in, database, our server code, and the invisible reCAPTCHA check |
| Google (Google Analytics) | Visit statistics for the public pages, only for visitors who allow them |
| Paddle (Paddle.com Inc., Paddle.com (Canada) Ltd or Paddle.com Market Limited, depending on where you are) | Our online reseller and merchant of record for orders placed through our website checkout. It takes the payment and handles your payment details as the seller, under its own privacy notice (see Payments) |
| Resend | Delivers our email — confirmations, trial notices, account letters |
| Cloudflare | The Turnstile check on the registration form |
| Microsoft | Hosts our info@trestlepath.com mailbox; our admin console reads that one mailbox so enquiries can be answered in one place |
| ipwho.is, then ipapi.co | Convert an IP address into an approximate city at the moment of sign-in. The address is not retained afterwards, and if both are unavailable the city is simply left blank |
Your choices
You may ask us at any time to show you what we hold about you, to correct it, or to delete your account. Deletion removes the account, its sign-in history, your subscription details and the technical records attached to it, is permanent, and takes effect immediately. A paid subscription has to be cancelled before its account can be deleted, so that nothing is billed to an account that no longer exists. Write to info@trestlepath.com.
Three things deliberately survive deletion, and we would rather say so than have you find out. The one-way hash recording that an email address has used its free trial is kept, because the trial is one per mailbox and deleting the account would otherwise reset it — it holds no name, no address and nothing else about you. Where access was withdrawn after a decision, a record of that decision and the reasons for it is kept until an owner explicitly deletes that case, because an account that has been removed cannot otherwise be accounted for later. And our billing records — the log of billing and administrative actions on the account (what was done, when, and the email address it concerned, including the deletion itself), the orders made and changes booked on it, the record of Paddle’s notifications about its subscription, and any billing matter or unmatched payment set aside for checking — are kept for seven years, counted as the table above sets out, and then deleted automatically, because they are our record of what was charged, changed, refunded or decided, and we may need them for accounting, tax or a dispute. They hold no card or bank details. All three are held only for those purposes. If you want any of them reviewed, write to us. Invoices and payment records for orders through our checkout are Paddle’s, not ours, and deleting your account here does not delete them.
If you would rather not have sign-in and connection activity recorded at all, please contact us before registering, as it is part of how licences are enforced.
Changes
If this notice changes in a way that affects what we collect, registered users will be told by email before the change takes effect.