Privacy notice

Last updated 3 November 2026

The controller is Fedor Dyatlov, a sole trader (NIE Z2250042A) at Avenida de Carritxal 2, 03560 El Campello, Alicante, Spain, reachable at fedordyatlov@outlook.com.

What is stored, and why

• Your email address — as a SHA-256 hash, not in readable form. It exists so the free monthly allowance can be granted once per person rather than once per key, and so a purchase can be reattached to you if your key is ever lost. Because it is hashed, we can check whether a given address matches but cannot recover the address or write to you at it.
• Your IP address — also as a SHA-256 hash. Only a count is used, to limit how many keys and demo runs come from one address in a day.
• Your API key — as a SHA-256 hash. The key itself is shown once at creation and never stored. If you lose it, nobody can recover it, including us.
• Usage records: which endpoints you called, how many pages, renders and rows, and your credit ledger. This is what your bill is made of.
• The URLs you submit, in server logs and in job records.

What is not stored

Card numbers, billing addresses and names never reach this service. Stripe handles payment and holds that data as merchant of record; see Stripe's privacy policy. We receive only a payment confirmation carrying your key id, the pack you bought, and the hashed address described above.

Something worth knowing about the recipes

When the service compiles a site it has not seen, the resulting CSS selectors are cached per domain and reused for every customer. That is deliberate — it is why a site costs money to read once and nothing thereafter. The cache holds selectors and a domain name, not your data and not your identity, but it does mean another customer benefits from a site you were first to compile, and that the set of domains compiled is not private between customers.

The rows extracted for you are not shared. Job results are yours and are readable only with your key.

The Sheets add-on and your Google data

The Scrapewright add-on for Google Sheets fills columns from the pages you list in a spreadsheet. Installing it asks Google for permission to read and write your spreadsheets, to make requests to this service, and to run on a schedule.

What leaves your spreadsheet is deliberately small. We send this service the URLs in your URL column and the names of your other column headers — nothing else. Prices, notes, your own # columns, the sheet's name, other sheets in the file and other files in your Drive are never read and never transmitted. The values that come back are written into your sheet and into its Changes log, both of which stay in your Google account.

Your API key is held in Apps Script's per-user property store, which lives in your Google account and is readable only by this add-on when you are the one running it. It is not copied to our servers in readable form; see the hashing described above.

The add-on asks for permission over all your spreadsheets rather than only the open one because a scheduled refresh runs while no spreadsheet is open, and the narrower permission Google offers works only in a sheet you are looking at. It is used solely to reopen the sheet you turned refreshing on for. The add-on never enumerates, opens or reads any other file.

Limited Use. The add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to others except as needed to provide the feature you asked for, and no human reads it except where you have asked us to for support, where the law requires it, or for security. Google user data is not used to train any model: the HTML that a page compiler sees is fetched by this service from the public web, not taken from your spreadsheet.

Removing the add-on from a spreadsheet, or revoking its access at myaccount.google.com/permissions, stops all of this at once. Anything already written to your sheet is yours and stays there.

How it is protected

• In transit. The service answers only over HTTPS; plain HTTP is redirected, never served. That covers every call the add-on makes, the whole of this site, and the dashboard.
• At rest. The database sits on an encrypted volume (Fly.io, Paris region, platform-managed keys). Should the underlying disk ever be read without us, it reads as ciphertext.
• One-way by design. The three pieces of data that identify you — your email address, your IP address and your API key — are stored only as SHA-256 hashes, as described above. This is not access control that can be misconfigured; there is no readable copy to leak, and we could not produce one if compelled to.
• Secrets. Credentials the service needs (the model API key, the payment keys) are held in the host's encrypted secret store and injected into the running process. They are not in the source repository, which is public, and not in the database.
• Access. One person operates this service — the controller named at the top. Nobody else holds credentials to the host, the database or the secret store. There is no support team with a console, because there is no support team.
• Payments. Card details are entered on Stripe's own pages and never traverse this service. We receive a customer reference and the fact that a payment succeeded.

No service can promise it will never be breached, and this one does not. What it can say is that the data worth stealing was hashed before it was written, so a breach of the database yields usage counts and URLs rather than a list of people.

Third parties

• Fly.io — hosts the service and stores its database, in Paris.
• Stripe — processes payments and acts as merchant of record.
• Anthropic — receives the HTML of a page when a site has to be compiled, in order to produce selectors. This happens once per site, not per page, and only for sites that publish no catalogue of their own.

Nothing is sold, and nothing is shared for advertising. There are no analytics or tracking scripts on this site, no third-party fonts or embeds, and no cookies are set. The one thing kept in your browser is optional: on the account page, ticking Remember this key stores the key in your browser's local storage so you need not paste it again. It never leaves your device and a forget it button removes it.

How long it is kept

Account records and the credit ledger are kept while the account exists and for six years afterwards, because they are financial records. Server logs are kept for about thirty days. Compiled recipes are kept until the site changes enough that they stop working.

Your rights

Under the GDPR you may ask for a copy of your data, its correction, or its deletion, and may object to processing or complain to a supervisory authority — in Spain, the AEPD.

One honest limitation: because your email and IP are stored only as hashes, we cannot search for you by address. To identify your account, send your key id — never the key itself. To delete your account, email fedordyatlov@outlook.com with the key id; it is done within 30 days and confirmed by reply. Deletion removes the account, its hashes and its usage history, except the payment records Stripe and tax law require us to retain.

The legal basis is performance of a contract for everything needed to run your account and bill you, and legitimate interest for the rate limiting that keeps the free tier from being farmed.

Changes

The date at the top says when this last changed. Material changes will be announced here before taking effect.