Crunchy Sheets · Security
Security & data handling
Finance data deserves plain answers. This page covers what Crunchy Sheets can access, what leaves your spreadsheet, what gets stored, and who processes it.
What it can access
Crunchy Sheets requests four Google OAuth scopes — deliberately the most restrictive set that lets the product work. There is no Drive, Gmail, or Calendar access, and no ability to open spreadsheets you haven’t opened yourself.
spreadsheets.currentonly
Read and write cells, formulas, and formatting in the spreadsheet you currently have open. It cannot see any other file — not other spreadsheets, not your Drive.
script.container.ui
Show the sidebar and dialogs inside Google Sheets. Nothing outside the app window.
script.external_request
Send requests to Crunchy Sheets' backend so the AI can analyze your workbook. This is how the sidebar talks to the model.
userinfo.email
Read your email address to identify your account. Not your name, contacts, or profile.
Where your data goes
- 1
You ask a question in the sidebar. The add-on reads the open spreadsheet's structure (sheet names, headers, sample rows, formulas) and any ranges the analysis needs.
- 2
That context is sent over TLS to Crunchy Sheets' backend (Vercel), which calls Anthropic's Claude API. Neither stores your spreadsheet contents — processing happens in memory.
- 3
The proposed analysis streams back to your sidebar as a preview. Nothing touches your spreadsheet until you click Apply.
- 4
After you apply, Crunchy Sheets re-reads what it wrote and verifies it — error cells, hardcoded numbers where formulas belong, tie-out checks.
Subprocessors
Anthropic
AI model inference (Claude). Workbook context is sent for analysis; Anthropic does not train models on API data.
Sign-in and OAuth. Google verifies your identity; we never see your password.
Vercel
Backend hosting. Requests are processed in memory and streamed back to the sidebar.
Supabase
Account and usage records (email, plan, token counts, costs). No spreadsheet cell contents.
Stripe
Payments for paid plans. Card details never touch our servers.
Intuit (QuickBooks Online)
Only if you connect QBO. Report data flows from QBO into your open spreadsheet; tokens are isolated per user and revocable anytime.
Common questions
- Is my spreadsheet data used to train AI models?
- No. Analysis runs on Anthropic's commercial API, which does not train models on customer data. We don't train anything on your data either.
- What do you store?
- Account records (email, plan) and usage metadata (token counts, cost, which skill ran). We do not store your spreadsheet's contents. Workbook data is processed in memory to answer your request and discarded.
- What exactly leaves my spreadsheet?
- A structural summary of your workbook (sheet names, headers, sample rows, formulas) plus whatever specific ranges the analysis needs. It goes over TLS to our backend, then to Anthropic's API, and the answer streams back to your sidebar. Nothing is written to your sheet until you click Apply.
- Can Crunchy Sheets see my other files?
- No. The add-on uses Google's most restrictive spreadsheet scope (current spreadsheet only). There is no Drive access of any kind — this is enforced by Google's OAuth layer, not just by our policy.
- Do you have SOC 2?
- Not yet. We're a small operation and we'd rather be straight about that than perform compliance. What we do have: a minimal-scope architecture where the sensitive access simply doesn't exist, no long-term storage of sheet contents, and this page. A DPA is available on request.
- How do I get a DPA or ask a security question?
- Email contact@crunchy.tools. For security reports, put SECURITY in the subject line and we'll respond quickly.