Privacy Policy

2. Google account data we access

When you sign in with Google, you authorize HolySheet to access specific Google account information through Google OAuth. We request only the scopes needed to operate the Service:

• Basic profile information – Your Google email address, name, and profile picture (via OpenID Connect / email / profile). We use these to create and identify your HolySheet account and to display your identity in the dashboard.
• Google Sheets data – Read and write access to Google Spreadsheets you explicitly connect to HolySheet (scope: https://www.googleapis.com/auth/spreadsheets). This allows the Service to fetch rows, append rows, update cells, and otherwise perform API operations on sheets you register.
• OAuth credentials – Google access tokens and refresh tokens issued when you consent. These tokens let HolySheet call the Google Sheets API on your behalf while you are signed in and after your session ends (so your public API endpoints keep working).

We do not request access to your full Google Drive, Gmail, Contacts, Calendar, or other Google products beyond the Sheets scope described above. We only interact with spreadsheets you choose to link.

3. How we use Google and other data

We use the data we access or collect for the following purposes only:

• Authentication – Sign you in with Google, maintain your session, and associate API keys and registered sheets with your account.
• Providing the Service – Read and write the contents of Google Sheets you have linked when your API endpoints are called (for example GET, POST, PUT, or DELETE against your sheet data).
• Account and product operations – Show your connected sheets in the dashboard, enforce plan limits, track API usage metrics, and diagnose errors.
• Security and integrity – Detect abuse, prevent unauthorized access, and keep OAuth tokens valid (including refreshing expired access tokens).
• Support and legal compliance – Respond to privacy or support requests and meet applicable legal obligations.

We do not use your Google Sheets cell contents for advertising, marketing profiles, or training machine-learning models.

4. How data is stored

We store the following information in our database (hosted by Supabase):

• Account identifiers – Your Google user ID, email address, and account creation time.
• OAuth tokens – Your Google refresh token, a cached access token, and the access token expiry time, so we can access linked sheets securely on your behalf.
• Sheet connection metadata – For each sheet you register: Google spreadsheet ID, sheet/tab name, spreadsheet URL, and timestamps. We do not keep a permanent copy of your spreadsheet cell contents in our database. Row and cell data is read from or written to Google Sheets live when an API request is made.
• API keys – Stored in hashed form (with a short display prefix). Raw keys are shown only once at creation.
• Usage metrics – Aggregated daily request counts, latency totals, and status-code counts per API key and sheet for billing limits and reliability.
• Operational logs – Server logs may include IP addresses, timestamps, and error details for security and debugging. Logs are not used for advertising.

Data is stored on infrastructure provided by our hosting and database providers and is protected with industry-standard controls appropriate to the Service (including TLS in transit and access restricted to authorized systems).

5. We do not sell or transfer your data to third parties

We do not sell, rent, or trade your personal data or Google Sheets data to third parties. We do not transfer your Google account data or spreadsheet contents to unrelated third parties for their own marketing or commercial use.

We only share or disclose data in the limited situations below, and only as needed to operate the Service or comply with law:

• Google – To authenticate you and to read/write sheets you authorize, subject to Google's Privacy Policy.
• Service providers – Infrastructure partners that host our application and database (for example Supabase and our hosting provider). They process data only to provide services to us and are not permitted to sell your data.
• Legal requirements – If required by law, regulation, legal process, or to protect the rights, safety, or security of HolySheet, our users, or the public.
• With your direction – When you call your own HolySheet API endpoints (or authorize others with your API key), sheet data is returned or updated according to your requests. You control who holds those keys.

6. Data retention and deletion

Retention. We retain your account data, OAuth tokens, sheet connection metadata, API key records, and usage metrics for as long as your account remains active and as needed to provide the Service. Spreadsheet cell contents are not retained as a permanent database copy; they remain in your Google account and are accessed only when needed to fulfill API requests.

Deletion / account closure. You may request deletion of your HolySheet account and associated personal data at any time by emailing soneshjain6@gmail.com. After we verify your request, we will delete or anonymize your account data, including stored Google OAuth tokens, registered sheet metadata, API keys, and related usage records, generally within 30 days, except where we must retain limited information for legal, security, fraud-prevention, or accounting reasons.

Revoking Google access. You can also revoke HolySheet's access to your Google account at any time in your Google Account permissions. Revoking access stops new Google API calls; please also contact us so we can delete stored tokens and close your HolySheet account if you want full removal from our systems.

Deleting your HolySheet account does not delete the underlying Google Spreadsheets in your Google account; those remain under your control in Google Sheets.

7. Legal bases (where applicable)

Where data-protection laws such as the GDPR apply, we process personal data based on:

• Contract performance – To provide HolySheet (authentication, sheet APIs, and account features) you request.
• Legitimate interests – To secure, operate, and improve the Service in ways that do not override your rights.
• Consent – Where you grant Google OAuth consent for Sheets access; you may withdraw consent by revoking access or requesting account deletion.
• Legal obligation – Where we must retain or disclose information to comply with law.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Rectify or correct inaccurate data
• Erase your data (including account deletion)
• Restrict or object to certain processing
• Data portability
• Lodge a complaint with a supervisory authority

To exercise these rights, email soneshjain6@gmail.com. We will respond within a reasonable period and as required by applicable law.

9. Children

HolySheet is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last Updated" date. Continued use of the Service after changes take effect constitutes acceptance of the updated policy. For material changes, we may provide additional notice where appropriate.

11. Contact for privacy inquiries

If you have questions about this Privacy Policy, how we handle Google account data, or wish to request access or deletion, contact:

HolySheet
Email: soneshjain6@gmail.com
Website: holysheet.soneshjain.com