Privacy Policy
Effective date: 26 August 2026
This policy covers SheetForge Web (web.sheetforge.workers.dev), the free browser companion to the SheetForge Unity asset, and this documentation site (docs.sheetforge.workers.dev). SheetForge is operated by its individual developer (“we”); contact details are at the end of this page.
The short version
- We run no user database and keep no server-side copy of your data.
- Your sheet data is processed inside your browser; we do not sell data, run ads, or use analytics trackers.
- Signing in with Google is optional, and only needed to open or push Google Sheets — and even then the app can touch only the spreadsheet files you individually open for it. A service-account key file can be used instead; it is processed in your browser and never reaches our servers.
Data processed in your browser
The editing engine runs as WebAssembly inside your browser tab. Sheet content you load from a local file is parsed, validated, and edited locally; it is not uploaded to us. If you never connect a Google account or key, the app works entirely with local files and no account data at all. Your plugin list and presets are kept in this browser’s local storage only — they are not synced to us or to any account.
Google account data
If you choose to sign in with Google, the app requests exactly these permissions:
- Basic profile (
openid,profile) — your Google account identifier, display name, and profile picture, used only to keep you signed in and to show who is signed in. We do not request your email address scope. - Per-file spreadsheet access (
drive.file) — access to the spreadsheet files you explicitly open for the app, and only those. The first time you use a spreadsheet, you pick it once in Google’s own file picker; that grant is what lets the app read the sheets you open and write back the changes you push. This scope also covers files the app itself creates, though the app currently creates none.
The app requests no other scopes. It has no account-wide access to your Google Drive or your spreadsheets: it cannot list or browse your files, and a file you have not opened for it stays invisible to it.
Google’s file picker runs inside the page, so to open it the app fetches a short-lived access token (valid for at most one hour) for your own session from a same-origin endpoint and hands it to the picker. To be precise about what that means: while that browser tab is open, scripts running in the page hold a token carrying the per-file access described above — the same kind of trust the key-file option below places in the page, and the boundary our strict Content Security Policy exists to guard. The token is not stored, logged, or sent anywhere other than to Google.
SheetForge Web’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Service-account keys
Instead of signing in, you can pick a Google service-account JSON key file. The key is used inside your browser: the browser itself signs the token request and calls Google’s APIs directly, so the key, the signed request, the access token, and your sheet contents never reach our servers. If you choose to have the key remembered, the file’s text is discarded immediately and what is stored — on your device, in your browser’s storage — is a signing key that scripts on the page can use but cannot read back out. Because it stays on your device, anyone with access to that browser profile could recover it, so treat the device as you would treat the key file itself. The Forget key button removes it immediately, and the app also asks Google to revoke the current access token.
How your data flows
Requests to Google (reading a sheet, pushing changes) travel with the credential you chose. When you are signed in, they go from your browser through our hosting provider’s edge (Cloudflare Workers) to Google, using your own OAuth token; they are processed in memory to fulfil the request — we do not store sheet contents, and we do not use them for anything other than performing the action you asked for. When you use a service-account key, the requests go directly from your browser to Google and do not pass through our servers at all. Your OAuth tokens are kept in an encrypted, HTTP-only session cookie in your browser — we have no server-side token store. (When you open Google’s file picker, a short-lived token for your own session is handed to the page for that purpose, as described under Google account data above.)
Cookies
The web app uses only the essential session cookies set by its sign-in library (HTTP-only, encrypted). There are no advertising or analytics cookies. The documentation site sets a single functional cookie (locale) to remember your language choice; it is not used for tracking.
How we share Google user data
We do not sell, rent, share, transfer, or disclose Google user data (your profile information or your spreadsheet contents) to any third party. No analytics provider, advertiser, or data broker receives any of it. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models. The only parties that technically process it are the service providers listed below, in the roles described there; because nothing is stored server-side, there is also nothing we could hand over beyond what those providers transiently carry.
Service providers
- Cloudflare — hosts the app and the documentation site and carries the traffic described above. Like any host, it processes connection metadata (such as IP addresses) to deliver and protect the service.
- Google — provides sign-in and the Sheets API, acting on your instructions under your own Google account or service account.
How we protect your data
Mechanisms protecting Google user data, including sensitive spreadsheet content:
- Encryption in transit — all traffic uses TLS, and both sites send HTTP Strict Transport Security headers.
- Token protection — your OAuth tokens live only in an encrypted, HTTP-only, secure session cookie in your browser; they are never written to server-side storage or application logs, and there is no server-side token store to breach.
- Key protection — a service-account key you pick is processed in your browser only and never sent to us; if remembered, it is stored on your device as a signing key that page scripts cannot read back out, with the honest limit described under Service-account keys above.
- No storage at rest — we operate no database or file store, so spreadsheet content and profile data are processed transiently in memory and cannot be retained, leaked from storage, or accessed by anyone later.
- In-browser processing — sheet parsing, validation, and editing run inside your own browser; content leaves it only to fulfil the Google requests you make.
- Hardened delivery — the app is served with a strict Content Security Policy, and optional plugins are verified against pinned checksums before loading.
- Least privilege — we request only the scopes described above (no email scope, no account-wide Drive or Sheets access — spreadsheet access is granted file by file, only for files you open), and you can revoke access at any time from your Google Account.
Retention and deletion
We retain nothing server-side, so there is nothing for us to delete. To disconnect the app: sign out (clears the session cookie), and revoke SheetForge Web’s access at myaccount.google.com/permissions. If you told the app to remember a service-account key, press Forget key— or clear this site’s browser data — to remove it from your device.
Your rights
Depending on where you live, you may have rights to access, correct, or delete personal data. Because we keep no server-side personal data, these rights are in practice exercised through your Google account as described above; for anything else, contact us and we will help.
Children
The service is not directed at children and we do not knowingly collect their data.
Changes
If this policy changes, the new version will be published at this address with an updated effective date.