We designed ourselves out of the data path.

• Your records. No transactions, balances, statements or invoice lines are sent to Tabular as part of a run, on any configuration. One exception exists and it is described below.
• Your portal logins. We never ask for a username or password for any site you automate. The browser session you are already signed in to carries the authentication. Nothing you type is recorded, and where a password or one-time code belongs, the run pauses and hands the keyboard back to you.
• Your parameter values. Account selections, date ranges and anything else a workflow asks you for stay on your machine. They are referenced by name in the workflow, never by value, so there is nowhere in what we receive for a value to sit.
• A copy of your workflows. They are files in your own Google Drive, in a folder only this extension can open. We hold no private copy.
• Your documents. Statements and invoices the extension downloads are filed in your Drive. They are never uploaded to us, and we never read a PDF into rows.

All of it is keyed to the Google account you connect, and this list is exhaustive:

• Your account. Your Google account id, your email address, when we first saw it, and your plan. Connecting Google is what creates it — there is nothing to sign up for and no password of ours to have.
• Three counters a month. Model requests, tokens in and tokens out, as running totals per calendar month. Numbers only: there is no per-request record, so nothing can say when in a month a request happened or what it was about.
• A row per workflow run. How it ended, how long it took, the workflow’s own id, how many model requests it needed, and the origin it started at — the scheme and host, never a path. It does not record how many rows were found, what the columns were, any parameter, or anything from the page.
• A Stripe customer id, if you subscribe. So that a later subscription event can find your account. Card details are entered on Stripe’s own site and never reach us — not the number, not the name, not the billing address.

There is no retention window. These rows are kept until something removes them, and we would rather say so than publish a schedule we do not run. To have your account and its rows deleted, email hello@tabular.run.

A model writes and repairs workflows. It never runs one. When you press the button that asks for help, the page you are on — including the records visible on it — is sent through our server to the model provider, because the markup and the text in it are what a reader has to be written against. There is no version of this that works on a page with the data taken out.

Four things bound it:

• Only when you press it. Never during a run, never on a schedule, and never as part of telemetry. The screen that asks names the site and says the records are included.
• We write none of it down. Our server holds the request for the length of the call and does not even parse the page. What it keeps are the three counters above, taken from the reply.
• The provider is not told whose page it is. Your identity token stops at our server. What the provider does with the page on their side is governed by their terms rather than ours.
• Your own key removes us entirely. Name a provider, a key and a model in Settings and the page goes straight there, with nothing passing through Tabular. That is a narrower promise rather than a bigger one — the page still leaves your machine, to a third party you chose instead of one we chose.

Once a workflow exists, replaying it needs no model at all. It runs on your machine, the same way every time, offline.

Connecting Google leaves a durable credential — a refresh token — in this extension’s local storage. We say so plainly because it is the kind of fact a policy exists to state:

• It never leaves your machine. It is exchanged and renewed by a request from the extension straight to Google. Our servers are not in that path and never see it.
• It only opens what Tabular made. The grant cannot reach a single file this extension did not create — not elsewhere in your Drive, and not even a file you put in Tabular’s own folder yourself.
• It also proves who you are, and that part is meant for us. The other half of the grant opens no files: it mints a short-lived token, signed by Google, saying which account this is. That is the only Google credential the extension ever sends us, and it carries an address and an account id rather than access to anything.
• Disconnecting revokes it. The token is handed back to Google, which invalidates the grant and everything derived from it — rather than merely being forgotten locally.
• It is not encrypted at rest. Pretending otherwise would be worse than saying it. It sits on the same footing as your browser’s own cookies: anything with access to your profile directory has it.

The workflows in your Drive carry their parameter values, which means those values outlive the machine and are not encrypted by us. They go to your own Google account and nowhere else, they sit in a folder only this app can open, and you can revoke access or delete the folder whenever you like.

When a portal is redesigned, a break one person hits should become a fix everybody gets. That is what telemetry is for here, and it is the only per-user stream we hold. It comes in two flows:

• Operational counts. Whether authoring succeeded, whether a repair worked, whether a run finished, on which site. No page content of any kind.
• Structural detail, default on and one click off. The shape of a page and the logic of the steps, with the text stripped out. Turning it off costs you distilled community repairs and nothing else — every other part of the product works identically.

Four properties do the work, and they are enforced before anything is sent:

• URLs are templated, not hashed. /accounts/4829173/statements becomes /accounts/{num:7}/statements on your machine before transmission. Hashing an account number protects nothing, because the space is small enough to guess through.
• Page structure only. A skeleton of tags and roles with every text node and attribute value removed. Never text, never values, never screenshots.
• Rare sites are dropped. A site only enters the shared corpus once several separate installations have reported it, so a private portal used by one person cannot become identifiable through it.
• Never transmitted, at any setting. Parameter values, extracted records, document contents, full URLs, referrers, cookies, headers, and where your data is written to.

• Google. Your own account, holding your spreadsheets and your workflows. You grant access to it and can withdraw that access at any time from your Google account settings.
• The model provider. Only on the authoring and repair path described above, and only when you press the button — or not at all, if you bring your own key.
• Stripe. Payment, if you subscribe. Card details go to Stripe and never to us.
• Cloudflare. Serves this site and the small API behind it.

• Turn structural telemetry off. One switch in Settings, with nothing else degraded.
• Disconnect Google. Revokes our access to your Drive. Your sheets and workflows stay where they are, and remain yours to open and delete. Note that this does not by itself delete the account row described above — email us for that.
• Export a workflow. One button writes a JSON file, so you can keep a copy that depends on neither us nor Google.
• Delete everything. Your data is in your Drive: delete the files and it is gone, with no request to us needed.

Many portals prohibit automated access in their terms, including by the account holder. You are the party bound by the terms of the sites you automate, and it is worth reading them.

Tabular ships no evasion tooling of any kind — nothing that disguises your browser, routes through anyone else’s connection, or works around the checks a site puts up. That is a product boundary rather than a missing feature: it is the difference between automating your own accounts and scraping somebody else’s site.

Questions about any of this, or a deletion request, go to hello@tabular.run. If anything here turns out to be less than precisely true of what the extension does, that is a bug in the product or in this page, and we would like to hear about it either way.