Privacy Policy
Effective August 1, 2026
This policy describes what TalkingSheet ("we", "us") collects when you use the TalkingSheet web dashboard and the TalkingSheet Google Sheets add-on, and why. It's written to match what the product actually does — if something here ever looks wrong, that's a bug in the product or the policy, and we want to know about it.
What we collect
- Account info. Your email address, via Google Sign-In (Supabase Auth). We don't collect or ask for a password.
- Spreadsheet content, per request only. When you ask a question, generate/explain a formula, run the data-cleaning scanner, or build a report, the add-on sends the relevant sheet data (headers and rows, capped at 800 rows per request) to our backend, which forwards it to an AI provider to generate an answer. We do not import, crawl, or store your spreadsheets — only the specific range or sheet(s) involved in that one request ever leaves your browser/Sheets session.
- Short-lived answer cache. To avoid paying for and waiting on a duplicate AI call when you (or a teammate) ask the same question against the same data again, we cache the AI's response for 10 minutes, keyed by a hash of the question and the exact data sent. This cache is skipped entirely if you use your own AI provider key (see "Bring your own key" below).
- Usage metadata. Which action you took (ask, formula, clean, report), when, and how many credits it cost — used to enforce your plan's monthly limit and a daily abuse-prevention ceiling. We do not log the content of your questions or answers here, only the fact that an action happened.
- Billing data. If you subscribe to a paid plan, our payment processor (Polar) handles your payment details directly — we never see or store your card number. We keep a local record of your subscription status and plan so the product can enforce it.
- Support tickets. If you contact support through the dashboard, we keep the message thread so we (and you) can refer back to it.
Bring your own AI key (BYOK)
If you turn on "Use my own API key" in the add-on's Settings tab, your key is stored only in your own Google account's Apps Script user storage (PropertiesService) — it is never sent to, or stored by, our backend or database. It's attached to each request you make and used only for that request, then discarded.
What we don't do
- We don't sell your data.
- We don't use your spreadsheet content to train any AI model, ours or a third party's.
- The web dashboard never edits your spreadsheet — only the add-on does, and only using your own Google Sheets permissions, for actions you explicitly trigger (inserting a chart, highlighting rows, etc.).
Google Sheets permissions we request
The Google Sheets add-on asks for the following Google OAuth scopes. We request the minimum needed for each feature, nothing more:
- See, edit, create, and delete the spreadsheets you open the add-on in (
spreadsheets.currentonly) — to read the sheet data behind your question, and to write results back for actions you trigger, like inserting a chart or highlighting flagged rows. Limited to the spreadsheet you have open; the add-on cannot see any other file in your Drive. - Connect to an external service (
script.external_request) — to send your request to the TalkingSheet backend and get the AI-generated answer back. - Display and run third-party web content in prompts and sidebars (
script.container.ui) — to show the add-on's sidebar and any confirmation dialogs. - Run when you are not present (
script.scriptapp) — to send your scheduled digest email (if you've turned that feature on) at the time you chose, without you needing the sheet open. - Send email as you (
script.send_mail) — used only for the scheduled digest email feature described above, and only if you've enabled it. - See your primary Google Account email address (
userinfo.email,openid) — to identify your account, enforce your plan's usage limits, and let support look up your account if you email us.
TalkingSheet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: data from Google APIs is used only to provide and improve the features you directly request in TalkingSheet, is never used for advertising, and is never sold or transferred to third parties except as described in "Who we share data with" below, solely to operate the product on your behalf.
Who we share data with
Sheet data for a request is sent to the AI provider handling that request (Anthropic by default, or whichever provider you configured under BYOK) solely to generate the answer. Account and billing data is shared with Supabase (auth) and Polar (payments) as needed to operate the product. We don't share your data with anyone else.
Your controls
- Uninstalling the add-on stops it from sending any further sheet data.
- You can request deletion of your account and associated data at any time by emailing support@talkingsheet.app.
- Turning on BYOK routes your requests through your own AI provider key instead of ours.
Changes to this policy
If this policy changes materially, we'll update the effective date above and, for significant changes, let you know via email or an in-product notice.
Contact
Questions about this policy or your data can be sent to support@talkingsheet.app. Pro and Team plans can also reach us through the Support tab in the dashboard.