SheetPilot — Privacy Policy

Last updated: 2026-08-28 Applies to: the SheetPilot browser extension and the website at https://sheet.xeviora.com Published at: https://sheet.xeviora.com/privacy Contact: [email protected]

---

The short version

The rows SheetPilot extracts are written from your browser straight into your own Google Sheets™ spreadsheet. They do not pass through our servers, and we keep no copy of them.

Three things do reach us, and only these three:

1. Your account email — because a plan and a credit balance have to belong to somebody.
2. The text of a page, at the moment you ask for an AI extraction — sent to our server, forwarded to our AI provider, used to answer that one request, and not retained afterwards.
3. A recipe, if you save one — a set of CSS selectors describing where on a page a value sits. It records the shape of a page, never the content you extracted from it.

We do not sell data. We do not share it with advertisers. We run no analytics or tracking scripts inside the extension.

---

What the extension stores on your own machine

Held in the browser's extension storage, never uploaded except where noted:

• Your right-click menu definitions, automation graphs and saving targets
• Spreadsheets you have bound (the file ID and sheet name — not their contents)
• Your capture history (which page was saved, when, and to which sheet)
• Cached recipes, your interface-language choice and other settings

You can clear all of it by removing the extension.

Your Google account

Signing in to Google uses the browser's own account picker. The extension requests exactly one Google OAuth scope — https://www.googleapis.com/auth/spreadsheets, permission to read and write Google Sheets spreadsheets — and no other. It cannot list your files, browse Google Drive or touch anything you have not explicitly bound to it. The access token stays inside the browser; it is never transmitted to our servers. Revoke access at any time from your Google Account's third-party-apps settings.

AI extraction

When you press Extract, the visible text and a structural outline of the current page are sent over HTTPS to our server, which forwards them to our AI provider to be turned into rows. The request is answered and discarded — we do not store page text, and we have contractual terms with the provider against training on it. A credit is deducted only after a result comes back and parses successfully.

Automations, right-click menus and replayed recipes involve no AI call: they run entirely inside your browser, and nothing leaves it.

Payments

Subscriptions are processed by Paddle, which acts as merchant of record and handles your payment details. We never see or store card numbers.

Permissions and why they are needed

Exactly the permissions the extension declares, and nothing else:

Permission	Why
storage	Keeps your menus, automation graphs, learned recipes, bound Google Sheets spreadsheets, history and settings.
unlimitedStorage	Cached recipes and capture history can grow past the small default quota for heavy users.
sidePanel	The whole interface lives in Chrome's side panel, beside the page being captured.
contextMenus	Adds the right-click items you define, so a value can be saved without opening the panel.
tabs	Reads the active tab's URL and title so the panel knows which page it is about to capture, and so the source URL can be stamped into a column.
activeTab	Grants access to the page you are acting on, at the moment you invoke the extension.
scripting	Injects the collection script into tabs that were already open before the extension was installed or reloaded. Without it, those tabs fail silently.
identity	Signs you in to your own Google account so rows can be written to Google Sheets directly from the browser.
clipboardWrite	Copies the extracted preview table to the clipboard when you press Copy.

Host permissions

Host	Why
<all_urls>	SheetPilot's purpose is to capture any page you choose, so it cannot know the list of sites in advance. The permission is used only on the tab you act on, and only when you act. It is also what allows the collection script to be injected into tabs that were already open before the extension was installed or reloaded.
https://sheets.googleapis.com/*	The Google Sheets API your rows are written to — called directly from your browser with your own Google OAuth token.
https://sheet.xeviora.com/*	Our own backend: sign-in, plan and credit balance, AI extraction requests, and recipe sync.

Children

SheetPilot is not directed at children under 13 and we do not knowingly collect their data.

Your rights

Write to [email protected] to see, export or delete what is associated with your account. Deleting the account deletes the account record, the credit ledger and any recipes you saved to the cloud. Your Google Sheets spreadsheets are yours and are untouched by account deletion.

Changes

Material changes will be announced on this page with a new "Last updated" date, and — where the change affects what data is handled — inside the extension.

Trademarks

SheetPilot is an independent product and is not affiliated with, endorsed by or sponsored by Google LLC. Google Sheets, Google Drive and Google are trademarks of Google LLC.

Contact

[email protected]