Security & Privacy

1. Which Smartsheet permissions we ask for, and why

When you connect, Smartsheet shows you a consent screen listing the permissions below. The consent screen is served by Smartsheet, not by us — we never see your Smartsheet password, and we cannot grant ourselves a permission you did not approve.

Smartsheet’s permissions are granular rather than hierarchical: each one grants exactly the capability it names and nothing more. The names in the table below are Smartsheet’s own, defined in their OAuth documentation — so you can check our explanations against the source rather than taking our word for it. Smartsheet documents 18 scopes in total; we request six.

One optional extra permission

READ_USERS — which lets us list the users in your Smartsheet organisation — is not part of the standard connection. It is only requested if you opt in to the User & License Report, which requires a separate consent screen. It was deliberately kept off the default list: it is only useful to system administrators, and putting a directory permission in front of every user who will never use it is a poor trade.

2. Is your OAuth token stored, and how is it protected?

Yes, it is stored — it has to be, or you would have to re-authorise on every single click. Here is precisely how:

• It is held on our server, not in your browser. The token lives in our Redis store. Your browser only ever holds an opaque random session id that means nothing on its own and cannot be turned back into a token.
• It is encrypted before it is stored. The token is encrypted with Fernet (AES-128-CBC with an HMAC signature) before it is written. Someone who obtained a dump of the database would not get usable tokens out of it.
• It expires automatically. The stored token is deleted 30 days after it is issued, whether or not you log out.
• It can be revoked instantly. Because the token is server-side, deleting it immediately kills access for every device — something a token kept in a browser cookie could never guarantee.
• Your login session is separate and shorter. The session cookie is valid for 12 hours of inactivity, and is set HttpOnly (unreadable by JavaScript), Secure (HTTPS only), and SameSite=Lax (not sent on cross-site requests).

Smartsheet access tokens expire after about seven days — 604,799 seconds, per Smartsheet’s OAuth documentation. Rather than forcing you to reconnect every week, we store the accompanying refresh token — encrypted the same way — and use Smartsheet’s standard refresh grant to renew the access token transparently in the background.

3. Are your sheet contents stored, or processed transiently?

Transiently. Sheet contents are never written to our database.

The lifecycle of a bulk operation is: you pick the sheets, we fetch them from Smartsheet over HTTPS, compute the preview in memory, show you exactly what would change, and — once you confirm — write the changes back to Smartsheet. When the request finishes, the sheet data is gone from memory. There is no copy, no cache of your cell values, and no backup on our side.

The one thing that outlives the request is a job status record. Because a large bulk apply runs in the background, we keep a small record so your browser can poll for progress. It holds counts and status — how many rows were written, whether the job finished, and any error message — and it is deleted automatically one hour later.

The Sheet Backup tool works the same way: the zip containing data.csv, comments and attachments is assembled entirely in memory and streamed to your browser. We never keep a copy.

4. What happens to uploaded Excel and CSV files?

When you use Sync to Excel, your workbook is read directly into memory, updated there, and the result is streamed back to you as a download. It is never written to disk on our server — there is no uploads folder, no temporary copy left behind, and nothing to clean up. When the response has been sent, the file no longer exists anywhere in our system.

File attachments are the one case that briefly touches disk. When you attach a file to a Smartsheet row through our uploader, the file is written to a temporary location purely because the Smartsheet upload API requires a file handle, and it is deleted immediately once the upload completes — including if the upload fails.

5. What we actually store, and for how long

The complete list. If it is not in this table, we do not keep it.

6. AI features and your data

A small number of optional features use an AI model: the scratchpad’s rewrite, summarise and tag-suggestion actions, the dashboard copilot, and the weekly report generator. When you trigger one of these, the relevant text is sent to our AI provider (Google’s Gemini via Google AI Studio, or OpenRouter, depending on configuration) to generate the response.

This matters, so to be explicit: the bulk Smartsheet tools do not use AI and send nothing to any AI provider. Find & Replace, Remove Duplicates, Cross-Sheet Lookup, Clean Up Sheets, Rename Columns, Merge Sheets, Sharing Auditor, Sheet Backup and Sync to Excel are all ordinary deterministic code. AI is only ever involved in the features named above, and only when you actively invoke them.

7. Who else your data passes through

We run on hosted infrastructure rather than our own hardware. The providers involved are:

• Smartsheet — your data’s actual home; we are a client of their API. Their handling of it is governed by their own Privacy Notice, and their security posture, certifications and compliance programmes are documented in the Smartsheet Trust Center.
• Heroku — hosts the application and the Redis store holding encrypted tokens and job records.
• Appwrite — stores the account record (your email address and display name).
• Google AI Studio / OpenRouter — only for the AI features described above.
• Google Fonts — serves the web font used across the site.

We do not sell your data, share it with advertisers, or use it to train any model. The site runs no advertising trackers and no third-party analytics.

8. Encryption in transit and at rest

In transit

Every connection is HTTPS. The site sends an HSTS header with a one-year duration covering all subdomains, which instructs your browser to refuse to connect over plain HTTP even if a link tries to. All calls to the Smartsheet API are likewise made over HTTPS.

At rest

Your Smartsheet tokens are encrypted with Fernet (AES-128-CBC plus an HMAC signature that detects tampering) before they are written to storage. Since your sheet contents and uploaded files are never written to storage at all, there is no data-at-rest question for them to answer.

The application also sets a strict Content Security Policy, and a nonce-based script policy that blocks injected scripts from executing — the defence that matters most for a tool holding an API token.

9. What disconnecting actually does

Clicking Log Out performs four distinct actions, in this order:

• Revokes the token at Smartsheet. We call Smartsheet’s token revocation endpoint, so the token stops working immediately and permanently — not merely on our side.
• Deletes the stored token from our Redis store.
• Destroys the server-side session held by Appwrite.
• Clears the session cookie in your browser.

Afterwards, LetMeTakeCare has no means of reaching your Smartsheet account. Reconnecting requires a fresh trip through Smartsheet’s consent screen.

You do not have to take our word for it

You can revoke our access from your own side, without involving us at all. In Smartsheet, go to Account → Apps & Integrations, find LetMeTakeCare, and select revoke — Smartsheet documents the process in Review, manage, and sign in to apps and integrations. That cuts off access at the source, which is the guarantee that matters: it does not depend on us behaving correctly.

10. Deleting your data

Most of what we hold removes itself. Logging out revokes and deletes your token; job records expire within the hour; sessions lapse after 12 hours; sheet contents and uploaded files were never kept in the first place. Logging out therefore removes essentially everything that matters.

What remains is the account record — your email address and display name — and your activity counter. There is currently no self-service delete button for these. To have them erased, contact us using the details below and we will remove them. If you would like confirmation once it is done, say so in your message and we will reply.

11. Who operates LetMeTakeCare

LetMeTakeCare is built and operated by Daniel, an independent developer based in the United Kingdom. It is not a venture-backed company and has no staff beyond its developer — which is precisely why this page spells out the technical specifics rather than gesturing at a compliance department.

In data-protection terms, that developer is the data controller for the small amount of personal data described in section 5. If you are in the UK or the EU, you have the right to access, correct, or request erasure of that data, and to complain to your data protection authority — in the UK, the Information Commissioner’s Office.

12. Contact

For any question about security, privacy, or data deletion — or anything else — use the contact form. It reaches the developer directly. Please say if your message concerns privacy or security so it can be prioritised.

If you believe you have found a security vulnerability, please report it through the same form with enough detail to reproduce it, and allow a reasonable window for a fix before disclosing it publicly. Reports made in good faith are welcome and will not be met with legal threats.

13. Terms of use

LetMeTakeCare is provided as-is, without warranty. The bulk tools make real, immediate changes to your Smartsheet data, which is why every one of them shows a preview before it writes and why we recommend running the Sheet Backup tool before a large operation. You remain responsible for the changes you choose to apply, and Smartsheet’s own cell history is the authoritative record for reverting them.

We may suspend access that abuses the service — for instance attempting to bypass the fair-use limits on bulk write operations. Your use of Smartsheet itself remains governed by your own agreement with Smartsheet, to which we are not a party.

As a third-party application built on the Smartsheet API, LetMeTakeCare is also bound by Smartsheet’s Developer Agreement, which sets requirements on developers for data security and the handling of end-user information. That is an obligation we owe to Smartsheet in addition to the commitments made on this page.

This page is the current, authoritative statement of how LetMeTakeCare handles your data. Material changes will be reflected here along with the revision date at the top.

14. References

Every technical claim on this page can be checked against Smartsheet’s own documentation. If anything here contradicts these sources, trust them and tell us so we can correct it.

• Smartsheet OAuth guide — the authorization flow, the full list of access scopes, token expiry and the refresh grant.
• Smartsheet Developers portal — the API reference this application is built against.
• Managing apps and integrations — how to review and revoke a connected app from your Smartsheet account.
• Smartsheet Developer Agreement — the terms third-party developers such as us are bound by, including data-security obligations.
• Smartsheet Trust Center — security, compliance and data-residency information for the platform your data actually lives on.
• Smartsheet Privacy Notice — how Smartsheet itself handles your personal data.