Privacy

Updated 17 October 2026

MCP Sheets keeps what it needs to work and to stay safe from abuse. Nothing is sold and there are no ads. Cloudflare Web Analytics counts page views without cookies and without following you to other sites, and we count how the product is used (which tools agents call, how many edits) without names, ids or content.

What we store

• Your account: name, email address, and your password as a one-way hash.
• Your workbooks: their sheets and their full history (who changed what, when, and the note they left). Keeping that history is what the product does.
• Agents you connect: each API key (we keep only a hash, so we can't show it to you again), what it may open and when it was last used, and the apps you approved through sign-in.
• Sign-in sessions: the IP address and browser of each session, so a session can be checked and ended.
• Apps registering to connect: when an AI app registers with us or fetches a sign-in token, we record its IP address, approximate location and network, its user agent and its request headers (never cookies, passwords or tokens). This is how we spot abuse. These records are deleted after 90 days.

Who else handles it

• Cloudflare runs the whole service: the servers, the databases, sign-up bot checks (Turnstile), email and the page-view counts. Its request logs are kept for a few days for debugging.
• Sentry receives reports when something breaks: the error, the page address and the browser, plus timings for one in ten page loads. We remove request contents, cookies and API keys before they are sent. Nothing records your screen.
• Websites you link to: when a cell holds a link, our server fetches that page to show its title and picture. The site sees our server (as MCPSheetsBot), not you.

Public workbooks

Anyone with the link to a public workbook can read it, and so can their agents. We ask search engines not to index workbooks. The history of a public workbook shows people's names; email addresses stay hidden. Private workbooks are visible only to the people they are shared with and their agents.

Cookies and browser storage

Cookies keep you signed in, and only that. For a few seconds after an update your browser also keeps a note that stops a page from reloading over and over. There are no tracking cookies.

Deleting

• Delete a workbook from the ⋯ menu next to it in your workbook list. Its sheets and history are deleted for everyone.
• Delete your account from the account menu (your initials, top right). That deletes your workbooks with their history, your agent keys, approved apps and sessions, at once. Your name stays in the history of workbooks other people own where you made changes, because that history is theirs.
• Cloudflare's backups can hold deleted data for up to 30 days before it is gone for good.