Straight answers about accounts, streams, security and what happens to your data.
It lets you share a range of cells from your Excel workbook, live, with other people. You publish a range from your Excel; the people you approve see it update in their own Excel, in a web browser, or in a Python program, within moments of you changing it. Nobody has to email spreadsheets around or open a shared file.
An account (free to create, verified by email), Windows 10 or 11, Microsoft Excel 2016 or later for Windows (Microsoft 365 included), and our small Excel add-in. The add-in needs the free Microsoft .NET 8 Desktop Runtime; the installer checks for it and links to the download. People who only want to look at a stream can use the browser viewer and don't need Excel at all.
Not yet. Publishing and listening in Excel need the Windows add-in. On a Mac or in a browser you can still watch a stream with the browser viewer. If Mac support matters to you, let us know - it helps us decide what to build next.
See the Pricing section on the home page. While we're getting started we are keen to have people try it and tell us what works and what doesn't.
It should arrive within 15 minutes. Please check your spam or junk folder first. Then use the Check Status tab on the home page - it tells you whether the address is verified and lets you send the email again.
Go to Reset your password, enter your email, and we'll send a link to choose a new one. The Excel add-in has the same link on its sign-in window.
Both are on your dashboard under "Sign-in & security". "Sign out everywhere" ends every session, including the Excel add-in on other PCs.
There is no self-service button yet. Email support@xlstreaming.com from the address on the account and we will delete it, along with its streams and sharing lists.
Only you and the people you approve. Someone who knows a stream id can ask for access; nothing is shown to them until you approve the request, either in the add-in's Requests window or on the dashboard. You can also share a stream by email in advance, and remove a reader at any time - their connection is closed straight away.
No. Readers only receive. Only the publishing connection can write to a stream.
One live publisher per stream: the newest one takes over and the older one stops, with a message saying so. A second Excel on the same PC asks before taking over.
Usually well under a second. Rapid bursts of changes are combined (about four updates a second per stream, latest value wins) so fast-recalculating sheets don't flood readers. Readers see a "Live", "Stale" or "Cached" state so they always know how fresh the data is.
Yes - there's a small REST API and a Python package, so a script or a database job can feed a stream and Excel users can read it. They aren't published yet: email feedback@xlstreaming.com and we'll send you the API details and the Python client. One caveat - the API is still evolving, so we can't promise it will stay unchanged for long.
Everything between you and our servers - the web site, the add-in and the Python client - travels over HTTPS or secure websockets (TLS 1.2 or later). Nothing is sent in the clear.
Only the readers you approve. The data passes through our streaming server, which has to hold the current values in memory to send them to your readers, so it is not end-to-end encrypted - we could, in principle, read it there. We don't look at customer data, and it is not written to disk or shown in any administration screen. If you need end-to-end encryption, tell us; it is on our list.
Sign-in is handled by Supabase Auth, a widely used authentication service. Passwords are stored only as salted hashes; we never see or store your plain password, and the Excel add-in doesn't keep it either - it keeps a refresh token, encrypted by Windows for your user account. Password rules are enforced at sign-up, and repeated failed sign-ins from one address are rate-limited.
Yes. The dashboard shows your last and previous sign-ins with time, address and client (Excel, browser or Python), recent failed attempts, and when your password was last changed.
Web sessions end after 15 minutes without activity; a countdown lets you stay signed in. The add-in is not affected.
Not yet. It is on our list, and your interest helps us prioritise it.
Our installer isn't code-signed yet, so Windows SmartScreen and some antivirus tools treat it as unknown. The documentation explains the warnings, how to check the download, and what to do if your Excel is set to accept only signed add-ins.
No. Stream contents live only in the streaming server's memory while the stream is live, so they can be sent to your readers and shown to a reader who joins late. They are never written to disk. When a stream is deleted, or the server restarts (it restarts every night), the contents are gone.
Account details and stream records are kept for as long as your account exists, and deleted when the account is deleted. Stream contents are not kept at all (see above). We haven't yet fixed a retention period for sign-in history and server logs; when we do, we'll say so here. Visit statistics are kept for 25 months (see Privacy, below).
Your sign-in (a refresh token, never the password), your settings, a log file, and - so a workbook can show its last values before it reconnects - an encrypted copy of the tables you listen to. The copy is encrypted for your Windows user and cleared when you sign out or uninstall. Nothing is stored inside the workbook itself.
We use no advertising or third-party cookies and no third-party analytics. Signing in sets only the cookies needed to keep you signed in. If you choose "Allow optional cookies", we also set one first-party cookie containing a random id, which lets us see whether a visitor came back; it lasts about 13 months and never leaves our site. You can change your choice any time with "Cookie settings" at the bottom of the home page.
So we can tell which of our adverts and links bring people here, we record page views with the time, the page, the referring site and any campaign tags in the link, your browser and screen size, and a shortened IP address - the last part is removed before it is stored, so it identifies a network, not you. Visit records are deleted after 25 months. Cookie choices are kept so we don't ask again. We don't sell or share this data.
They are being written. Until they're published, this page is our honest statement of what we do with your data, and we'll keep it up to date. If anything here worries you, please ask.
We're new and we'd rather hear it from you. Questions, bugs, ideas, or just "this answer didn't help":
feedback@xlstreaming.com