HookSheet Privacy Policy
Effective date: November 2, 2026
HookSheet ("we") is a Google Sheets add-on, published by Tiny Lever, that lets a spreadsheet receive webhooks. This policy explains exactly what Google user data the add-on accesses, how it is used, shared, protected, kept and deleted.
1. Data we access
HookSheet requests five Google permissions:
- See, edit, create and delete only the specific Google Sheets spreadsheets you use this app with (spreadsheets.currentonly). Used to read and write the HookSheet settings and log tabs, to list your tab names, and to create the tab you choose for incoming rows, in the spreadsheet where you open HookSheet only.
- Create and update Google Apps Script projects (script.projects) and Create and update Google Apps Script deployments (script.deployments). Used only to add one script, "HookSheet receiver", to the spreadsheet you set up, upload its code, and publish it as a web app address. HookSheet never reads, lists or changes any other Apps Script project.
- Display and run third-party web content in prompts and sidebars inside Google applications (script.container.ui). Used only to show the HookSheet menu and sidebar.
- Connect to an external service (script.external_request). Used only to (a) call Google's Apps Script API to create and update your receiver, (b) send a test request and a status check to your own receiver address, and (c) send the Pro license key you type in to our payment provider, Gumroad (api.gumroad.com), to check that it is valid.
HookSheet does not access your email address, contacts, Drive file list, Gmail or any other Google data, and does not collect aggregated or anonymized data about you.
2. The receiver in your spreadsheet
The "HookSheet receiver" script is created in, and owned by, your own Google account. It runs as you, inside Google, and writes the webhook data it receives into your spreadsheet. Its code is visible and editable by you (Extensions → Apps Script). When you authorize it, Google asks you to allow it to see and edit your spreadsheets (needed so the web app can open this spreadsheet by its ID) and to show a menu. It only opens the spreadsheet it was created in.
3. How we use the data
Data is used only to set up your receiver and to write incoming webhook data into your spreadsheet, as you configured. We do not use any data for advertising, analytics, profiling, lending decisions or training AI/ML models.
4. How we share the data
- Webhook data travels from the sender directly to Google's servers and into your spreadsheet. It never passes through Tiny Lever: we have no servers.
- Your license key is sent to Gumroad to verify a purchase.
- We do not sell, rent or transfer any user data to anyone, including data brokers, advertisers or AI providers.
5. How we protect the data
- Everything runs inside Google's infrastructure under your own account, over encrypted HTTPS.
- Each webhook gets a random secret token by default; requests without it are rejected and logged.
- Incoming text that looks like a spreadsheet formula is stored as plain text, so webhook data can't run formulas in your sheet.
- The add-on is technically restricted (via its manifest's URL allowlist) to contacting only Google's Apps Script API, your own receiver address and api.gumroad.com.
6. Data retention and deletion
- Webhook data and settings live in your spreadsheet (your data tabs, a hidden "HookSheet settings" tab and a hidden "HookSheet log" tab with the last 200 requests). We keep no copy.
- Stored in your Google account by Apps Script: the receiver's IDs and address for this spreadsheet, your license key and the date it was last checked.
- To delete: delete the HookSheet tabs, delete the "HookSheet receiver" project (Extensions → Apps Script → Project settings, or script.google.com), use Account → Remove license, and uninstall HookSheet from Extensions → Add-ons → Manage add-ons. You can also email us and we will help.
7. Limited Use
HookSheet's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.