Skip to content

Privacy Policy

Last updated 6 August 2026

The short version.

Spend2Sheet can only see the folder and spreadsheet it creates in your Google Drive, never anything else. That limit is enforced by Google, not by our promise.

Your expenses are stored only in your spreadsheet. We keep no copy of any vendor, amount or date. The app reads your sheet when you open it, and that is the only record there is.

We never sell your data, never use it for advertising, and never use it to train AI models.

What Spend2Sheet does

Spend2Sheet is a web app for people who keep their expenses in a spreadsheet. You upload a receipt, invoice or bill as a photo, a PDF, or typed text. Spend2Sheet reads it, pulls out the date, vendor, amount and currency, and writes them as a new row in a Google Sheet inside your own Google Drive. The original file is saved to a folder in that same Drive and linked from the row.

The spreadsheet in your Drive is the product. There is no separate Spend2Sheet ledger holding a second copy of your expenses. When you open the app, it reads your sheet.

To do this, Spend2Sheet uses your Google account in two separate steps. Signing in uses your name, email address and profile picture. Later, on its own screen, the app asks for one Google Drive permission, drive.file, which grants access only to files the app itself creates or that you explicitly choose. It cannot list, read or modify anything else in your Google Drive.

Who we are

Spend2Sheet is operated by the team behind spend2sheet.online.

If you have a question about anything here, write to support@spend2sheet.online.

What we access in your Google account

When you connect Google, we ask for exactly these permissions and nothing more:

  • Your name, email address and profile picture, so we can sign you in and show you which account you are using.
  • Permission to create and manage only the files Spend2Sheet creates in your Drive (the drive.file scope). This is a per-file permission. It lets us create your Spend2Sheet folder and your financial-year spreadsheet, and write to them afterwards. It gives us no ability to see, list, open or search any other file in your Drive, including files we did not create.

If you choose a specific folder to put Spend2Sheet inside, we gain access only to that folder for the purpose of creating our folder within it. We still cannot read the files that were already in it.

We do not request access to Gmail, Contacts, Calendar, Photos, or your wider Drive, and we have deliberately designed the product so that we never need to.

What we store

Your spreadsheet and your Drive folder are not a copy of your records. They are the records. There is no second copy on our side. What we hold is the configuration needed to reach them:

  • Your account: email address, name, profile picture.
  • Your settings: currency, financial year, time zone, language, and the columns you have configured.
  • Your Google connection: an encrypted token so we can keep writing to your sheet without asking you to sign in every time, plus the identifiers of the folder and spreadsheet we created.
  • A count of how many expenses you have added, so we can spot abuse. Not what they were.

No vendor, amount, date, tax figure or invoice number is stored by us at any point. When you open the app it reads your spreadsheet directly. Close it and nothing about your expenses remains on our servers.

One consequence worth knowing: because we hold nothing, if Google is unreachable we cannot show you your expenses, and a receipt that fails to save is not held for later. You will be told plainly and can try again. We consider that a fair trade for not holding your financial records, and it was a deliberate choice.

Receipt files and extracted text

When you send a receipt, the file passes through our servers only for the seconds it takes to read it and upload it to your Drive. It is never written to our storage. A receipt waiting for your approval is held in your own browser, not on our servers, until you approve it. Your Drive keeps the only lasting copy.

The text we read out of a document is never written to disk. It exists only for the moment it takes to pull the details out, and is gone when that request finishes.

How we use AI

We use AI models to read receipts and pull out the details. The document is sent to our model provider solely to produce that result.

Your data is never used to train AI models, ours or anyone else’s. Our model provider is contractually barred from training on data sent through their API.

Providers may hold a copy briefly, typically up to 30 days, for abuse monitoring before deleting it. We are working towards zero-retention routing, which removes even that. We will update this page when it is in place rather than claiming it early.

Limited use of Google user data

Spend2Sheet’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer Google user data to third parties except as necessary to provide the service, we do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with the law, or where the data is aggregated and anonymised.

Who else processes your data

We use a small number of providers to run the service. Each sees only what it needs to:

  • Vercel: hosting. Receipts pass through its servers in memory and are not stored there.
  • Neon: the database described above.
  • Our AI model provider: receives the receipt in order to extract its details, under the retention terms described above.
  • Google: your own Drive and Sheets, on your behalf.

We do not sell your data to anyone, for any purpose, ever.

Deleting your data

You can delete your account at any time from the Account page in the app. When you do, we revoke our access to your Google account and delete your settings and connection. There is no copy of your expenses to delete, because we never had one.

Your folder and spreadsheet stay in your Drive. They are yours, they always were, and deleting your Spend2Sheet account does not touch them. If you want them gone too, delete them in Drive.

You can also disconnect Google without deleting your account, which stops all further access immediately. Revoking access from your Google account settings has the same effect.

Security

Google access tokens are encrypted before they are stored, and are never sent to your browser or written to our logs. All traffic is over HTTPS. Access to production systems is limited and audited.

No system is perfect. If you believe you have found a security problem, please write to support@spend2sheet.online and we will respond quickly.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you. Your expense data is already in your own spreadsheet, so export is generally a matter of opening it. Write to us and we will help with anything else.

Children

Spend2Sheet is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

If we change what we collect or how we use it, we will update this page and change the date at the top. For anything significant, we will tell you directly rather than relying on you to check.