Workbook Tools

Privacy policy

Last updated: 17 October 2026

Operator and scope

Shipit Software Limited operates Workbook Tools and XLSX Editor by Loam. This policy covers the Workbook Tools website, the local Windows and macOS desktop editors, the XLSX browser extension, the iOS and Android mobile editors, XLSX Editor by Loamstack for ChatGPT, and the XLSX Formula Checker MCP. Optional connected Loam services have their own account, authorization and data handling information; opening a workbook locally does not upload it to those services or make it available to a connected assistant.

XLSX Editor in ChatGPT

XLSX Editor by Loamstack opens the XLSX workbook you select through the ChatGPT extension host. The host grants access to that file, and the embedded editor reads and processes its contents in the editor frame using the bundled workbook engine. No separate Workbook Tools account is required. The extension does not search your device, open unrelated files or access your cloud accounts.

Edits and undo history remain in the open editor’s memory until you choose Save. Saving asks the host to update the selected file and requires write permission and a current file version. A conflict or unavailable write access can prevent saving. Closing or reloading the editor can lose unsaved work. If you choose Export copy and the host supports downloads, the host creates a separate output rather than silently replacing your source. The host controls its own file storage, permissions, downloads and retention under its applicable policies.

Our extension server supplies the opening tool and editor assets. The opening call receives the selected file reference and file details, but the editor reads and writes workbook contents through the host rather than uploading them to our MCP server for editing. Cloudflare serves these requests and may process ordinary network and security information, such as IP address, requested path and timestamp.

The embedded extension does not send workbook contents to our analytics, the separate XLSX Formula Checker MCP or optional AI-help providers. It does not execute macros or external data connections. ChatGPT handles information shared with it under its own terms and privacy controls. Opening a file in this editor does not authorize a separate remote formula-tool call. Use our support form for help and provide a fictional example rather than private workbook contents or credentials.

Local workbook processing and storage

The browser tools process workbooks on your device. The desktop editor reads workbooks you explicitly choose or open through the operating system and processes them on your device. Workbook contents, file names, sheet names, cells, formulas and exported data are not included in the editor's analytics or error reports and are not sent to our application servers by local editing.

The desktop app holds editing and undo state in memory. Saving writes to the local destination you choose; temporary local files may be used to prepare and complete a save. Your original workbooks and saved outputs remain under your control. Closing the app ends its in-memory editing session; it does not delete your saved files.

When you open a file from a website page, the browser may save that original workbook and edited workbook snapshots in IndexedDB on this device. A random session ID in the app URL identifies that local record; copying the URL does not share your workbook. These records support app entry and refresh recovery beyond a single tab. They expire for recovery 30 minutes after entry or an edited snapshot; expired records are cleaned up during later use, rather than guaranteed to be physically deleted at that exact time. Clear this website’s browser storage to remove its saved local records. Browser storage may be denied, cleared or evicted, so save an XLSX download to keep a permanent copy.

Browser-local batch conversion may write temporary results to this site’s private storage on your device. Removing a result clears its temporary copy. Interrupted conversions or downloads can leave temporary files until later cleanup; unused copies older than 24 hours are eligible for cleanup during subsequent conversions. Clear this site’s browser data to remove these local copies. Downloaded files remain until you remove them.

XLSX browser extension

The XLSX Editor browser extension opens only workbooks you explicitly choose or drop into its bundled editor. It processes workbook contents locally using bundled scripts, fonts and WebAssembly. It has no webpage-reading permissions or content scripts and does not automatically read pages, downloads, folders or cloud accounts.

Workbook bytes, cell values, formulas, sheet names, file names and editing history remain in the open extension tab’s memory. The extension does not put workbook data in URLs, browser storage or remote requests. It sends no automatic analytics or error reports. Closing or reloading the tab clears its working state. Downloading creates a separate output file; it does not overwrite your source workbook automatically. Your source files and downloaded outputs remain under your control.

Keep a downloaded copy of your changes and check it before replacing an original workbook. Opening a website or support link is a separate, deliberate action; that website handles its own requests under the website section of this policy.

Website requests

Website pages, scripts, fonts, styles, samples and other site assets travel through our hosting infrastructure. Cloudflare hosts and protects the website and may process IP addresses, browser details, requested paths, timestamps and security signals to deliver and protect it. The website does not currently set analytics cookies or collect workbook-content analytics.

Remote MCP and optional AI help

The XLSX Formula Checker MCP is a separate remote workflow. It receives only the cells, formulas, questions or base64-encoded workbook explicitly supplied in a tool call. Those inputs leave your device and are processed on our server infrastructure. Opening a workbook in the browser or desktop editor does not make it available to the MCP. The MCP does not discover local files or automatically read assistant attachments.

No Workbook Tools account or user API key is required for this MCP. Cloudflare receives MCP requests at the website edge and forwards deterministic workbook calls to our existing Rust backend hosted on Railway. Railway processes the explicitly supplied workbook inputs in memory for the call; files and workbook sessions are not saved. These hosting providers may process ordinary network and security information. Send only data you are authorized to share, and prefer a small fictional example when checking a formula.

When you request optional AI formula help, the supplied formula, question and context are sent from our server to OpenRouter and the selected model provider to generate a response. Our OpenRouter credential stays on the server. Provider processing and retention depend on their applicable policies and settings; we do not promise that provider inputs are never retained. AI help is separate from deterministic formula checks and can be unavailable.

Deterministic workbook calls are stateless: we do not save the supplied workbook or keep workbook sessions between calls. Cloudflare processes and may retain ordinary network request and security information separately under its applicable policies. Optional AI help has the separate provider processing and retention described above. Remote tool calls are subject to service limits and do not save changes to a workbook on your device.

Desktop analytics and diagnostics

Released desktop builds send limited application-start analytics to PostHog and application lifecycle and error diagnostics to Sentry. These help us understand aggregate app activity, diagnose failures and maintain reliability. Reports contain application and technical metadata such as the app name, version, platform, build environment and sanitized error or stack information. Diagnostic messages and metadata are filtered to exclude document contents, file names, local file paths and contact details.

For analytics, the app creates a random identifier for this app installation and stores it in the app's local webview storage so it can be reused across launches. It creates a separate random session identifier in memory for each launch. Neither identifier is derived from your account, hardware, operating system identity or workbook. If local storage is unavailable, analytics uses a session identifier instead. We use these identifiers to measure active installations and sessions; PostHog person-profile creation is disabled.

PostHog and Sentry receive these reports as service providers. Sending a report also exposes ordinary network connection information, such as an IP address, to the receiving service. The configured desktop collection endpoints are in the United States.

PostHog can retain IP addresses and derive approximate location from them; this is not a request for precise device location. Random identifiers and the absence of person profiles do not make these reports anonymous. We use analytics and diagnostics only to operate and improve our apps, not for advertising, data brokerage, or joining these identifiers to an identified person. We do not use these reports to track you across other companies’ apps or websites.

Retention and controls

The random installation identifier stays in the app's local webview storage until that storage is cleared. Clearing the app's local data removes the local identifier; a later launch may create a new one. This does not erase reports already received by a service provider. The session identifier and editing state are held in memory for the running session.

We retain operational analytics and diagnostics only as reasonably needed for reliability, security and legal obligations, subject to the service providers' storage and retention controls. Our current PostHog product-analytics plan retains events on a rolling seven-year basis. Sentry error reports are retained for 90 days and Sentry logs for 30 days. Earlier deletion may occur under provider controls or an applicable deletion request. The current desktop editor has no in-app analytics opt-out control. You can stop using the app, clear its local data, or use your operating system's network controls to restrict its connections.

Contact and support requests

If you deliberately submit a request through our public support form, your reply email and message are sent to PostHog support records. No Loam account is required. Information is sent only when you choose Send request; opening the form, typing, or leaving it sends no support request. No workbook is attached or automatically read. These deliberately submitted fields are kept separate from routine desktop telemetry, use a request-specific identifier, and do not create a PostHog person profile. The form does not save your message or email in local storage.

PostHog also receives ordinary network information when a request is sent and can retain IP-derived approximate location. Support requests stored as PostHog events follow the rolling seven-year event retention described above. Do not include private workbook contents or credentials. For support, privacy questions, or a request concerning reports already received, use our support form and include a request reference when available. We may need information to identify the relevant report before acting on a request.

Security and changes

Local processing reduces the need to share workbook data, but no software or network service is risk-free. Keep backups and check saved outputs before replacing your only copy. We may update this policy as the service changes; the date above identifies the current version. Our Terms govern use of the service.