Privacy policy
Effective and last updated November 15, 2026. Quietlathe LLC, a Wisconsin limited liability company ("we", "us"), runs SheetLatch.
Who we are
Quietlathe LLC, a Wisconsin limited liability company. Mailing address: 2800 E. Enterprise Ave Ste 333, Appleton, WI 54913. Email: ops@quietlathe.com. We are the controller of the personal data described here.
Where SheetLatch stands today
SheetLatch is in early access. The website is live. The API, the free tool, accounts, the dashboard and checkout are not open yet. Where this policy covers those, it says "when this feature is live" and describes what we plan to do. We will update this page before they open if anything changes.
What we collect, and why
| Data | Why we use it |
|---|---|
| Site visits. Our host, Cloudflare, processes your IP address, user agent and the pages you request to serve and protect the site. | To deliver the pages and block abuse. |
| Early-access signup. Your email address, the plan you pick (optional), the page path you signed up from, a timestamp, and a one-way hash of your IP address. | To email you once when checkout opens. The IP hash is used only for spam rate limits, and we cannot turn it back into your IP address. |
| Messages to us. Anything you send to ops@quietlathe.com. | To answer you. |
| Account and billing data, when this feature is live. Your email, a sign-in record, API key hashes, the sheet id and tab each key is tied to, monthly request counts, and from Stripe a customer id and the plan you bought. | To run your account, enforce plan limits, send sign-in links and usage notices, and handle refunds. |
No emails are sent from the early-access list today. Later we send one email per product when checkout opens. Anyone can ask to be removed by writing to ops@quietlathe.com. We never sell or share the list.
Your sheet data, when the API is live
- Public sheets. When your app calls the API, we fetch the tab from Google's public export for sheets set to "Anyone with the link".
- Private sheets (paid plans). You share a sheet with our Google service account. We use the official Sheets API and can read, and write when you call a write endpoint, only sheets you have shared with that account. We do not ask for access to your Google account or Drive, and there is no Google sign-in. You can remove the share at any time and access stops.
- Cache. We keep a copy of the rows in a cache (Cloudflare) for the refresh window, 60 seconds by default and no more than one hour, which is used only as a fallback if Google cannot be reached. Rows are not kept after that and not used for anything else. Our logs record error messages, not rows or request bodies.
- Free tool. The sheet link you paste is sent to our server, which reads the sheet and makes a key tied to that sheet. A one-way hash of your IP address is used to limit free keys per day.
- You are responsible for having the right to share the data in your sheet. If a sheet holds other people's personal data, you are the one deciding to send it through SheetLatch.
API keys are stored as SHA-256 hashes and shown to you once.
Who else handles data
- Cloudflare hosts the site, runs our server code, cache and database, and processes request data such as IP address and user agent. Cloudflare privacy policy.
- Google, when the API is live, serves the sheet data we read and write. Google privacy policy. SheetLatch is not affiliated with Google.
- Stripe, planned. When checkout opens, payments will be processed by Stripe. We never see or store full card numbers. Stripe privacy policy.
- Resend, planned, sends our transactional email (sign-in links, usage notices, the one launch email). Resend privacy policy.
We do not use AI providers to process your data. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We may disclose data if the law requires it.
Cookies and browser storage
We do not set cookies, and no analytics or advertising tools run on the site. The site does not use localStorage or sessionStorage today. Cloudflare may use technical signals to protect the site. When accounts open, the dashboard will keep a sign-in session token in your browser's sessionStorage, which clears when you close the tab.
How long we keep data
- Early-access list: until we have sent the launch email and a reasonable time after, or until you ask us to remove you, whichever is first.
- Account data, when this feature is live: while your account is open, then up to 12 months, except what we must keep for tax or legal reasons.
- Sheet rows: only in the cache, for the window described above.
- Hosting request logs: kept by Cloudflare for a short period under its own settings.
Security
We use HTTPS, store keys as hashes, and keep access to our systems limited. No system is perfectly secure, and we cannot promise it is.
Your rights in California and other US states
If you live in California, you may have the right to know what personal information we collect, use and disclose, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We will not treat you differently for using these rights. Other states may give similar rights.
To make a request, email ops@quietlathe.com from the address you used with us. We verify you by matching the request to that address, and may ask for one more detail. An authorized agent may send a request for you with your written permission, and we may confirm it with you. We aim to respond within 45 days.
Visitors in the EEA and UK
Quietlathe LLC is the controller (contact above). Our lawful bases are: your consent when you join the early-access list (you can withdraw it at any time by emailing us); performance of a contract when you have an account; our legitimate interests in running and protecting the service and preventing spam; and legal obligations. You have the right to access, correct, delete, restrict or object to our use of your data, to data portability, and to withdraw consent. You may complain to your local data protection authority. Contact us first and we will try to fix it.
International transfers
We are in the United States, and Cloudflare and our other providers may process data in the US and other countries. If you are in the EEA or UK, your data may be transferred outside it. Where required, we rely on the safeguards our providers offer, such as standard contractual clauses.
Children
SheetLatch is not directed to children under 13, and we do not knowingly collect their personal information. For visitors in the EEA and UK, we do not knowingly collect data from anyone under 16. If you think a child has given us data, email us and we will delete it.
Changes
We may update this policy. The date at the top changes when we do, and we will note material changes on this page.
Contact
Quietlathe LLC, 2800 E. Enterprise Ave Ste 333, Appleton, WI 54913. ops@quietlathe.com.