Privacy

Last updated August 8, 2026. This describes what Typesheet collects when you use the service, why we hold it, and who else touches it.

What we collect

  • Account. When you sign in with Google we receive your email address, name, and profile image from Google via Supabase Auth. We do not receive your Google password. Sign-ups from disposable inbox providers are rejected.
  • Your sheets. The fields you define, the types and rules you set on them, the corrections you keep so they replay on the next file, and each sheet's settings, including any webhook destination and whether it has a live import link.
  • What you import. The files you upload, cells you paste, and links you paste, plus the rows they produce. We keep the rows in the sheet, along with each cell's value, whether it passed, and where the value came from: the file, an edit you made, an edit the sender made, or a correction replayed from an earlier import.
  • What other people send you. A sheet with an import link can be sent data by someone with no account. We store the rows they submit, the name they type for themselves (self-reported, never verified), and a one-time secret that lets them come back and fix their own submission. The sheet's owner sees that submission; other senders do not.
  • Usage. A log of metered requests: which route, when, which account, and the requesting IP address. It enforces plan quotas, per-minute rate limits, and the daily ceilings on the expensive operations (reading a PDF or a screenshot with a model, fetching a pasted link). IP is what bounds the paths that work without an account, so it is stored rather than derived.
  • API keys and connected agents. API keys are stored as a SHA-256 hash plus a short display prefix; the full key is shown once at creation and cannot be recovered. Connecting an assistant over MCP stores the client registration and the tokens issued to it.
  • Billing. Payment is handled by Polar, which acts as merchant of record. We never see or store your card details. We store your Polar customer and subscription identifiers and your plan tier.

What we do not do

  • No advertising, no ad networks, no data brokers, no selling of your data.
  • No third-party analytics or tracking scripts. The site sets no ad cookies.
  • We do not use your sheets or the data imported into them to train our own models, and the model providers we use are configured not to train on API traffic.

Who processes your data

Four companies hold or read customer data, each only what its job needs:

  • Vercel: hosting and request serving.
  • Supabase: database, authentication, and file storage for the files you import.
  • Anthropic: the models that read a PDF or a screenshot into rows, match your file's columns to your fields, and answer questions about a sheet. Receives the file or the rows involved in that request, and is configured not to train on it.
  • Polar: checkout, subscriptions, invoices, and tax.

Beyond those, one kind of service is called for one specific action and never receives your rows: a page-rendering service, sent only the address, when a pasted link cannot be read by a plain fetch. Our fonts and icons are served to your browser by Google Fonts, which means your browser makes a request to Google carrying its IP address and the page it is on. Write to hello@typesheet.com for the current list of every provider by name.

Cookies

Typesheet sets only functional cookies: your Supabase session cookie, and a ts_ws cookie remembering which workspace you last worked in. There are no analytics or advertising cookies, and nothing to consent to that isn't required to keep you signed in.

Import links, and data you send onward

An import link is an address anyone holding it can post data to, without an account. Turning one on is a choice you make per sheet, and rotating the link retires the old address. Senders are told which sheet they are sending to and which fields it accepts, and they see their own submission and nothing else in the sheet.

If you set a webhook destination, clean rows are POSTed to the https address you typed when an import is marked ready. Exports (CSV, JSON, PDF) leave with you. Once data has left on either path it is outside our control and covered by whatever handles it next, which is worth knowing before you point a sheet at a third-party endpoint.

Retention and deletion

We keep your data while your account is open. Email hello@typesheet.com to have your account and its sheets, imports, stored rows, and uploaded files deleted, and we will action it within 30 days. Deleting a sheet deletes the rows it holds and the imports that fed it. Billing records are retained by Polar as long as tax and accounting law requires.

If someone sent you data

When you send rows through somebody else's import link, they hold that data, not us: we process it for them. Ask them to change or remove it. If you cannot reach them, write to us and we will pass the request on and tell you we have.

Your rights

Depending on where you live, you may have the right to access, correct, export, or erase your personal data, and to object to certain processing. Write to hello@typesheet.com and we will answer within the period the applicable law allows. Any sheet can be exported to CSV or JSON from the app at any time, without asking us.

Security

Data is held in Supabase with row-level security so one account cannot read another's. Secrets we hold on your behalf (API keys, OAuth tokens, the per-submission edit token) are stored hashed or generated per submission, never left in the clear where a shared identifier would do. No system is perfectly secure, and we do not claim otherwise.

Changes

If this policy changes materially we will update the date above and, for significant changes, notify account holders by email.

Questions: hello@typesheet.com. See also our Terms.