Privacy Policy

This Privacy Policy describes how sheety.work ("we", "our", or "the Service") collects, uses, and protects information when you use our Chrome Extension, Web Application, and Telegram Bot.

1. Architecture & Data Flow

sheety.work operates across two primary interfaces with distinct data flows:

• Chrome Extension: Webpage text extraction runs in the browser context. Extracted rows are written directly from your browser to your Google Sheet via the Google Sheets API using your local Google OAuth token. We do not store or persist the contents of your spreadsheet rows in our application database.
• Telegram Bot (@sheetywork_bot): When you send URLs or text to the Telegram bot, our backend edge functions fetch the target text, perform the extraction, and append the record to your selected Google Sheet on your behalf using an encrypted OAuth token stored in Supabase Vault.
• Transient Extraction Processing: Webpage or clipboard text sent for extraction is processed in volatile memory during the request lifecycle to extract structured JSON and is not permanently saved to our application database. For the Telegram bot, a temporary in-memory session cache of the most recent message per chat is kept to support follow-up questions (such as /ask).

2. Information We Collect and How It Is Stored

• Account Information: We store your email address and unique User ID via Supabase Auth to manage user accounts, authentication sessions, and quota limits.
• Collection Metadata: We store table configuration metadata (collection name, Google Spreadsheet ID, column header names, and optional user extraction instructions) in Supabase database with Row Level Security (RLS) so that the Service knows which columns and spreadsheet to target.
• Usage Logs & Billing: We maintain record counts of extractions in a usage log to track plan quotas, as well as Stripe customer and subscription identifiers for Pro plan billing.
• BYOK API Keys: If you configure your own AI provider API keys (OpenAI, Anthropic, Google, Moonshot Kimi, OpenRouter), these keys are stored strictly in your local browser storage (chrome.storage.local). They are never transmitted to or stored in our database.
• Telemetry & Diagnostics: We record operational product events (such as collection creation, extraction attempts, row saves, template IDs, and generic error categories) linked to your User ID to monitor service performance and troubleshoot technical errors.

3. Google User Data & OAuth Compliance

sheety.work accesses Google user data via Google OAuth 2.0. We request only the minimal necessary scope:

• https://www.googleapis.com/auth/drive.file: Grants access only to Google Drive files that you create through sheety.work or explicitly select and authorize via the Google Picker interface. The Service cannot access, view, or modify other files in your Google Drive.

In accordance with the Google API Services User Data Policy:

• We do not sell Google user data to third parties.
• We do not use Google user data to serve advertisements, including personalized, retargeted, or interest-based advertising.
• We do not use Google user data to train, retrain, or fine-tune generalized artificial intelligence (AI) or machine learning (ML) models.
• Google OAuth refresh tokens required for the Telegram Bot integration are stored in encrypted storage (Supabase Vault) and are accessed only by automated backend services to append rows to your authorized spreadsheets upon your command.

4. Third-Party Service Providers & AI Processing

To provide extraction and infrastructure services, data is shared with the following third parties:

• Cloud Infrastructure: Supabase (Authentication, PostgreSQL Database, Encrypted Vault) and Cloudflare (Edge Hosting and DNS).
• Hosted AI Extraction: For users utilizing hosted extractions, page text is sent via HTTPS to the Google Gemini API. Google Cloud's API terms specify that customer data sent through paid/commercial Gemini API endpoints is not used to train Google foundation models.
• Bring Your Own Key (BYOK) AI: When you provide your own API key, requests are sent directly to the selected provider (OpenAI, Anthropic, Google, Moonshot, or OpenRouter) subject to the respective provider's developer API terms and privacy policies.
• Payment Processing: Stripe processes payment card transactions. We do not store credit card numbers on our servers.
• Telegram: Interactions with @sheetywork_bot are processed via Telegram's Bot API subject to Telegram's privacy policy.

5. Data Retention & Account Deletion

We retain your account information, collection metadata, and usage counters for as long as your account is active. You may request deletion of your account and associated database records by contacting support@sheety.work. You can disconnect your Google account from the Telegram bot at any time using the /logout command.

6. Security

We apply reasonable technical safeguards to protect your data, including HTTPS/TLS encryption in transit, Row Level Security (RLS) on database tables, and encrypted storage in Supabase Vault for backend OAuth tokens.

7. Contact

For questions or privacy requests regarding this Privacy Policy, please contact us at support@sheety.work.