Privacy policy
Last updated October 23, 2026. Operator: Kyle Judson, doing business as SheetMiles, Holden, Massachusetts, USA. Contact: [email protected].
Summary
SheetMiles is a Google Sheets add-on. It reads your Google Calendar events and writes a mileage log into the spreadsheet you have open. That processing runs inside Google's Apps Script environment under your own Google account. Your calendar events, addresses and mileage log are not sent to our servers. Our server only receives your Google account email address (through a Google-signed identity token) so it can check your trial or subscription.
Google user data we access and why
| Permission (scope) | What we do with it |
|---|---|
| See your calendars and events (calendar.readonly) | Read the events in the calendar and date range you choose: title, description, location, start time, whether it's all-day, the event type (so working-location, out-of-office and focus-time entries are skipped) and your own RSVP (so declined invitations are skipped). Used only to build your mileage log. We never create, change or delete events. |
| View and manage the spreadsheet the add-on is used in (spreadsheets.currentonly) | Write the "Mileage Log" and "Mileage Summary" tabs, and read the log back when you export. No other spreadsheets or Drive files are accessed. |
| Your email address, and OpenID (userinfo.email, openid) | Identify your licence. A Google-signed token containing your email is sent to our licence server. |
| Connect to an external service (script.external_request) | Call our licence server (trial/subscription status and checkout links). No calendar or sheet data is included. |
| Send email as you (script.send_mail) | Only when you click "Email PDF + CSV to me" or turn on the monthly email: sends your own log to your own address. We never email anyone else. |
| Run while you're away (script.scriptapp) | Only if you turn on the monthly email: a monthly trigger that builds last month's log and emails it to you. |
| Display content in Sheets (script.container.ui) | Show the SheetMiles sidebar. |
To calculate driving distances, event addresses are passed to the Google Maps service that is built into Apps Script. That request goes from your Google account to Google and is covered by Google's own terms and privacy policy. Calculated distances for address pairs are cached in your Google account's add-on storage so the same trip isn't looked up twice.
Google API Services: Limited Use disclosure
SheetMiles's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve the user-facing features described above.
- We do not transfer Google user data to others except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with notice to you.
- We do not use or transfer Google user data for serving ads, including retargeting, personalized or interest-based advertising.
- We do not sell Google user data, and we do not use it to determine creditworthiness or for lending purposes.
- No human reads your Google user data, unless you ask us to for support and give us explicit permission, it's needed for security purposes (such as investigating abuse), or it's required by law.
- We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
Data we store on our servers
- Your Google account email address, the date you first used SheetMiles and your trial end date.
- If you subscribe: your Stripe customer ID, subscription ID, plan, status and renewal date.
- Stripe webhook event IDs (to avoid processing the same payment event twice), deleted after 90 days.
- Short-lived abuse-prevention counters (rate limits) keyed by a one-way hash of the IP address or email; they expire within minutes and never contain the address itself.
- Server logs kept by Cloudflare for a few days (request time, path, status and error messages) to keep the service running. They don't contain calendar or sheet data.
Our licence server runs on Cloudflare (Workers and D1). Payments are handled by Stripe, which receives your email and payment details directly (if you buy on this website, the email you type is sent to Stripe for the receipt); we never see or store card numbers. If you email support, we keep that conversation to help you.
How we share data
We don't sell, rent or share Google user data with anyone for their own purposes. Data goes only to these service providers, and only to run SheetMiles:
- Google: event addresses go to the Google Maps service in Apps Script to get driving distances, and the emails you ask for are sent through Google's Apps Script mail service.
- Cloudflare hosts our licence server and database. It stores your email address, trial dates and subscription status.
- Stripe processes payments. It receives your email address when you start checkout or open billing.
Your calendar event contents, addresses and mileage log are never shared with Cloudflare, Stripe or us.
Data stored in your Google account
Your SheetMiles settings (base addresses, keywords, vehicles), cached distances and a cached licence status are stored in Apps Script user properties in your Google account. The mileage log lives in your spreadsheet, which you own and control.
Retention and deletion
We keep licence and billing records while you use SheetMiles and for as long as required for tax and accounting records afterwards. To delete your licence record, email [email protected] from the account's address and we'll delete it within 30 days. Billing records we must keep for tax law are kept without any calendar or sheet data. We don't keep calendar events or mileage logs, so there's nothing of that kind to delete on our side. To remove data in your Google account, uninstall the add-on and remove its access at myaccount.google.com/permissions; delete the log tabs from your spreadsheet if you wish.
Security
Connections use HTTPS. Licence requests are authenticated with Google-signed identity tokens that our server verifies. Stripe webhooks are signature-verified.
Children
SheetMiles is not directed to children under 13.
Changes
We'll update this page and the date above if this policy changes. Material changes will be announced in the add-on.