Hunch

Privacy

Last updated 29 September 2026.

What gets sent when a formula runs

The text in the cells you point a formula at, your question, and the options or levels you wrote. It travels from Google Sheets to our server, and from our server to TypeSafe, whose Jev model computes the answer. Nothing else in your spreadsheet is read.

What we store

• Your key, its credit balance, how many rows it has used, and when it was last used.
• The email address and Stripe session id from your purchase, so we can find your key if you lose it.
• If you ask for a trial key, the email address you enter, stored with that key so we can send it and so each address gets one trial. We do not add it to any mailing list.
• If an assistant or program asks for a free key without an email (hunch_get_key, or POST /trial with source agent), the key record holds no email at all.
• Counters of what assistants and programs do (see “Connecting from an AI assistant” below), kept for 90 days. They hold an event name and the client's name, never text, keys or addresses.

We do not store the text of your cells, your questions, or the answers. They pass through and are gone when the response is sent back to your sheet. We keep a key record until you ask us to delete it.

How we protect your data

Security procedures are in place to protect the confidentiality of your data, including the Google user data described below.

• Encryption in transit. Every connection is encrypted with HTTPS (TLS): from Google Sheets, Excel and AI assistants to our server, from our server to TypeSafe, and from our server to our database. This site tells browsers to use HTTPS only (HSTS).
• No copies of your cells. Cell text, questions and answers are processed in memory to compute the answer. They are never written to our database or our logs.
• Hashed sign-in tokens. When an AI assistant connects, we store only a SHA-256 hash of each token it receives, never the token itself. Access tokens expire after 30 days and refresh tokens after 60.
• Restricted access. Only the people who run Hunch can reach the production database, hosting, email and payment accounts. The passwords and API keys our server uses are kept in protected environment variables at our host, Vercel, not in our code.
• Limits against misuse. Sign-in attempts, trial requests, checkout and contact messages are rate-limited per IP address, and each key has a daily row limit, so a leaked key cannot be drained in one go.
• Card data. Payments go through Stripe. Card numbers never reach our server.
• If something goes wrong. If we learn of a security incident that affects your data, we will email the affected users without undue delay, say what happened, and say what we did about it.

What stays in your sheet

Answers are cached inside your own spreadsheet for six hours using Google's document cache, so recalculation does not spend credits. That cache is part of your Google account, not ours.

Analytics and cookies

Two tools tell us which pages help people and where visitors come from.

• Vercel Web Analytics counts page views without cookies.
• Google Analytics 4 measures visits and a few actions: sending the free-rows form, starting and completing a purchase, copying the template, downloading the Excel add-in, copying a formula and running the CSV runner. It sets first-party cookies (_ga and _ga_NN5DGNL6QV) that last up to two years. In the EU, the UK and Switzerland they stay off until you choose Allow in the cookie bar. Elsewhere they are on unless you choose Decline. Google Analytics does not store IP addresses. We keep event data for 14 months and do not use it for ad targeting or ad personalization.

The first time you visit, the site remembers in your browser where you came from (for example a search engine or Product Hunt) and sends that label with the free-rows form, so we know which channels bring people. To change your cookie choice, clear this site's data in your browser and the bar appears again.

Connecting from an AI assistant

When you use Hunch from Claude, ChatGPT, Gemini or another assistant through our MCP server, the texts and the question the assistant sends follow the same path as a formula: to our server and to TypeSafe to compute the answer, and they are not stored.

When you connect Hunch from an assistant, Hunch keeps a sign-in record so the assistant can call Hunch for you. It holds the name of the app that connected, the address that app returns to, and hashed access and refresh tokens tied to your key. The tokens expire on their own, and if you ask us to delete your key they stop working at once. To limit abuse, Hunch counts sign-in, registration, trial and contact requests per IP address for up to one day, and keeps a row count per key for two days for the daily limit. Those counters are used for nothing else.

The keyless connection at /mcp/try gives each network address a small free sample each day, and each address a couple of free keys a day. To enforce that, Hunch keeps a one-way hash of the address (not the address itself) next to a counter for up to two days. Hunch also counts, per day, how many times each kind of client (for example claude-code or cursor) connected, listed tools, called a tool, ran out of credits or opened a checkout link, and how many purchases came from an assistant's link. Those counts carry only the event name and the client's name and are kept for 90 days, to see whether Hunch works for assistants. A checkout link that an assistant hands you holds a random one-hour ticket that points to your key on our server; the link does not contain the key, and the assistant cannot pay for you.

Third parties

• TypeSafe computes the answers. Their published policy states that customer requests are not used for training. See docs.typesafe.ai/legal.
• Stripe handles payment. We never see your card details.
• Vercel runs our server and hosts this site.
• Upstash stores keys, credit balances, purchase emails, and contact-form messages (Redis, EU region).
• Resend sends the key email and forwards contact-form messages.
• Google runs the spreadsheet and the script inside it, under your own Google account and Google's terms, and provides Google Analytics for this site.

Google user data

This covers the script inside the template and the Hunch add-on for Google Sheets. They ask for three permissions, and only when you use the Hunch menu. Formulas alone need no authorization.

• See and edit the spreadsheet you use Hunch in (spreadsheets.currentonly). Used to read the cells you select for Ask about selection and to write the answers into the next column. No other spreadsheet, file or folder is opened.
• Connect to an external service (script.external_request). Used to send the selected text and your question to our server, which returns the answers, and to check your credit balance.
• Show Hunch dialogs inside Sheets (script.container.ui). Used for the Ask about selection form, the Set API key box, Help, and the links to buy credits or get free rows. The dialogs load nothing from other sites.

The cell text and your question go to our server and to TypeSafe only to compute the answers, and are not stored, as described above. Your Hunch key is saved inside the spreadsheet: in its Settings sheet, or in the document's own properties when you use Set API key. The script cannot open your other files, read your email, or see your Drive. We do not sell Google user data, share it beyond the processors listed above, use it for advertising, or use it to train AI models. Nobody at Hunch reads it. It is protected in transit as described in How we protect your data.

Hunch does not use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized AI or ML models, and does not let TypeSafe or any other provider do so.

Hunch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your data

Write to us through the contact form with your key or purchase email and we delete the key record. Unused credits on a deleted key are gone with it.

Contact

Write to us through the contact form. Security reports go through the same form.