Privacy policy

Scrubsheet. Last updated 23 September 2026

Scrubsheet anonymizes spreadsheets on your own device. The short version: we never receive your spreadsheets, their contents, or the results. This page explains the little we do handle and what you can ask us to do about it.

1. Who is responsible

Scrubsheet is published by a sole trader established in Finland. Under the General Data Protection Regulation (GDPR), the data controller for the personal data described on this page is:

2. What this policy covers

This policy covers the Scrubsheet website at scrubsheet.dripwork.dev, the browser tool on it, and the Scrubsheet add-in for Microsoft Excel. The Dripwork privacy policy covers the dripwork.dev website. Where the two differ about Scrubsheet, this page applies.

3. Your spreadsheets

We do not collect, receive, store or see the spreadsheets you anonymize. That includes their contents, file names, sheet and column names, and the anonymized results.

• Browser tool. Your file is read and processed by the page, in your browser, and the result is saved straight to your computer. The page's Content-Security-Policy (connect-src 'none') makes the browser block every network request the page could try to make, so it cannot send your data anywhere, including to us.
• Excel add-in. The add-in reads the range you choose from your open workbook, processes it inside the add-in, and writes the result back into your workbook. The add-in has the same network block and has no server of its own to send data to.

Because we never receive this data, we are not a processor or controller of the personal data inside your spreadsheets. You stay in control of it, and of any obligations you have towards the people it describes.

4. What this website collects

Nothing directly. There is no account, no form, no analytics, no advertising and no cookies. The site is a set of static files.

Our hosting provider processes limited technical data to deliver the site and protect it from abuse: typically your IP address, browser user agent, the page requested and a timestamp.

• Purpose: serving the website, and detecting and preventing attacks.
• Legal basis: our legitimate interests under Article 6(1)(f) GDPR in keeping the site available and secure.
• Retention: short-lived, controlled by the hosting provider.

5. What is stored on your device

Some settings can be kept in your browser's (or the add-in's) local storage, on your device only. Nothing is stored for identifying or tracking you, and none of it is sent to us.

You can remove these at any time: untick the box, delete the preset, remove the licence key, or clear the site's data in your browser settings.

6. The Excel add-in and Microsoft

Excel add-ins must load Microsoft's Office JavaScript library (Office.js) from Microsoft's content delivery network. When the add-in opens, your device requests that library from Microsoft, which receives the usual technical data of such a request (such as your IP address). No spreadsheet data is sent with it. Microsoft handles that request, and your use of Excel itself, under its own privacy statement.

If you get the add-in through Microsoft Marketplace, Microsoft handles the listing and installation under its own terms.

7. Licence keys

Scrubsheet Pro for Excel is unlocked with a licence key. Today the key is checked on your device and nothing is sent anywhere.

We plan to add an online licence check. When we do, it will send the licence key and nothing else to us, to confirm the licence is valid. Like any web request it also carries technical data such as your IP address. It will never include spreadsheet data, file or sheet names, or information about your use of the add-in. We will update this policy before that check goes live.

8. If you contact us

When you email us, we receive what you put in the message: your email address, your name if you include it, and the content. We use it to answer you and to keep a record of support matters.

• Legal basis: our legitimate interests under Article 6(1)(f) GDPR in answering people who contact us; where the message concerns buying or using Scrubsheet, Article 6(1)(b).
• Retention: general correspondence up to 12 months after the matter is closed; support correspondence up to 24 months.

Please never send us the spreadsheet you are working on, or real personal data from it. Describe the problem with made-up values instead.

9. Who processes data for us

These act on our instructions. We do not sell personal data or share it for advertising.

10. International transfers

Cloudflare, Inc. is based in the United States. Zoho stores mailbox data in the data centre region selected for our account. Where personal data leaves the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses, an adequacy decision such as the EU-US Data Privacy Framework, or another safeguard allowed under Chapter V GDPR.

11. Your rights

If you are in the EEA or the UK, you have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent where we rely on it. To use any of these, email aqib@dripwork.dev. We answer within one month, and it is free.

Since we never receive your spreadsheets, we cannot access, correct or delete data inside them: that data is only on your device.

12. Complaints

Please tell us first so we can put things right. You also have the right to complain to a supervisory authority. Ours is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) in Finland, at tietosuoja.fi. If you live in another EEA country, you may complain to your local authority instead.

13. Changes

If we change how Scrubsheet handles personal data, we update this page and the date at the top first. Questions go to aqib@dripwork.dev. See also the terms of use.