Privacy policy

Last updated 28 October 2026

This policy covers the apps published by Onibaku ("we", "us") on the Atlassian Marketplace, the Google Workspace Marketplace, the HubSpot App Marketplace, the Chrome Web Store and Firefox Add-ons, our web apps (such as ChatBundle), our licence server, and this website. We've kept it short because our apps are built to collect as little as possible.

CQL Search & Table Export for Confluence

Where it runs

The app is built on Atlassian Forge and runs entirely on Atlassian's infrastructure. It does not send any data to servers operated by Onibaku or anyone else.

What it reads

When you use the app, it reads Confluence content through Atlassian's APIs as you, the signed-in user: search results (titles, spaces, authors, dates, labels, excerpts and links) and, when you export tables, the body of the page you're on. This is shown to you in your browser and, if you choose, saved to a file on your device. We never see it.

What it stores

The only data the app stores is your saved searches: the name you give each one, the query, and your column choices, linked to your Atlassian account ID. It is kept in Atlassian's Forge storage for your site, is visible only to you through the app, and is deleted when the app is uninstalled from your site (in line with Atlassian's data retention for Forge apps). You can delete individual saved searches at any time in the app.

What it doesn't do

• No analytics, tracking or advertising.
• No access to content you don't already have permission to view.
• No sale or sharing of data with third parties.

Calendar Timesheets & Billing for Google Sheets

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers. Your calendar events are read and written into your spreadsheet there. They are never sent to Onibaku or anyone else.

What it accesses, and why

• Your calendars, read-only (calendar.readonly): the list of calendars you can see, and the events in the date range you choose, including each event's title, times, description, location, colour, attendee email addresses and your response. Titles, times and the calendar name are written into the timesheet. Description, location, attendees and colour are only used to work out which client an event belongs to, following the rules you set, and are not stored. The add-on can't create, change or delete events.
• The current spreadsheet only (spreadsheets.currentonly): to write the timesheet and summary tabs into the spreadsheet you're using the add-on in. It can't open your other files.
• Your Google account's email address (userinfo.email): to preselect your own calendar and to check your plan with our licence server.
• Showing the sidebar (script.container.ui) and connecting to an external service (script.external_request): the latter is used only to contact our licence server.

What it stores

Your add-on settings (chosen calendars, date range, client names, rates and matching rules, and display options) are saved in the spreadsheet's add-on storage, so anyone you share the spreadsheet with who also uses the add-on can see them. The timesheet itself is ordinary spreadsheet data that you control. Your plan status is cached in Google's per-user add-on storage so the add-on keeps working if our server is briefly unavailable. See below for how long this is kept and how to delete it.

Our licence server and payments

When the add-on checks your plan, it sends your Google account's email address to our licence server at licence.onibaku.co.uk. If you've never bought Pro, nothing is stored. If you buy Pro, we store your email address, a licence key, your Stripe customer and subscription IDs, and your subscription status and renewal date, so we can unlock Pro and handle support. We keep this for as long as you're a customer and for 6 years afterwards for tax records, then delete it.

So we can tell which parts of the add-on people use and where they get stuck, the add-on also tells the licence server when you open the sidebar, build a timesheet, or see or answer the request for a review. We store only a daily count of each, against an anonymous ID made from your email address with a one-way keyed hash. The email address itself isn't stored, and nothing about your calendar or spreadsheet is ever sent. These counts are deleted after 400 days.

Payments are processed by Stripe, which collects your card and billing details directly. We never see your full card number.

How your data is protected

• Your calendar data never leaves Google. It is read and processed inside Google Apps Script, under your own Google account's permissions, and written only into your own spreadsheet. Onibaku has no copy of it and no way to access it.
• Least access. The add-on asks for read-only calendar access and access to the current spreadsheet only. It can't change your calendar or open your other files.
• Encrypted in transit. The only data that leaves Google is your email address and the usage counts described above, sent over HTTPS (TLS) to our licence server. The add-on's manifest restricts it to that one address, so it can't contact any other server.
• Restricted server access. The licence server isn't directly exposed to the internet. It sits behind an HTTPS proxy that reaches it over an encrypted private network, and only Onibaku's administrator can access the server or its database. Plan checks aren't logged, usage counts hold no email addresses, and our server logs don't contain email addresses.
• No card data. Card details go straight to Stripe, which is certified to PCI DSS Level 1. We never receive or store them.

How long data is kept, and how to delete it

• Calendar events: we don't keep them. They're held in memory only while a timesheet is being built, inside Google's servers.
• Timesheets and summaries: ordinary cells in your spreadsheet. They stay until you delete the tabs or the spreadsheet.
• Saved settings and cached plan status: kept in Google's add-on storage until you delete them. You can remove them at any time with Extensions → Calendar Timesheets & Billing → Delete my add-on data. The cached plan status also expires on its own after 6 hours. The backup copy used when our server is unreachable is replaced at every check and stops being used after 7 days.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections. It then stops reading your calendar immediately.
• Licence records (Pro customers only): kept while you're a customer and for 6 years afterwards, as UK tax law requires. To have your record deleted or anonymised sooner, email admin@onibaku.co.uk. We'll do it within 30 days, keeping only what the law requires.

Who we share Google user data with

Your calendar events and spreadsheet are never shared with anyone. The only Google user data that leaves Google is your Google account's email address, and it is shared, transferred or disclosed only to:

• Onibaku's licence server (licence.onibaku.co.uk), which we run ourselves in the UK, to check your plan as described above. Its public HTTPS address is on a server hosted for us by DigitalOcean in London, which relays requests to it.
• Stripe, our payment processor, only if you choose to upgrade: your email address is passed to Stripe Checkout so it's filled in for you and the payment can be matched to your account.
• Courts, regulators or law enforcement, only if the law requires it.

If Onibaku or this add-on were ever sold or merged, we would ask for your explicit consent before any Google user data was transferred. We don't share Google user data with anyone else, including advertisers, data brokers and AI providers.

Google user data

Calendar Timesheets & Billing's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No third-party analytics, tracking or advertising. The anonymous usage counts above stay on our own server.
• No access to Gmail, Google Drive or your other files.
• No sale of data, and no sharing beyond what's listed under “Who we share Google user data with” above.

Sheet to Calendar Sync for Google Sheets

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers. Your spreadsheet rows are read and your calendar events written there. They are never sent to Onibaku or anyone else.

What it accesses, and why

• Your calendar events (calendar.events): to create, update and delete the events that rows in your spreadsheet describe, including their title, times, description, location, guests, colour, repeats and reminders. It reads an event before changing it, so it can keep guests' replies and anything your sheet doesn't set, and so the last sync can be undone. It only changes events created from your spreadsheet, plus any event you point a row at.
• The list of your calendars (calendar.calendarlist.readonly): so you can pick which calendar to add events to. It can't change your calendars or their sharing.
• The current spreadsheet only (spreadsheets.currentonly): to read your rows and write each event's sync status and ID back to the sheet. It can't open your other files.
• Running when you're not there (script.scriptapp): only if you turn on automatic syncing of form responses, to add an event when a response arrives.
• Your Google account's email address (userinfo.email): to check your plan with our licence server.
• Showing the sidebar (script.container.ui) and connecting to an external service (script.external_request): the latter is used only to contact our licence server.

What it stores

Your add-on settings (which columns hold what, the chosen calendar and options) are saved in the spreadsheet's add-on storage, so anyone you share the spreadsheet with who also uses the add-on can see them. Each row's event ID and sync status are written into two columns of your sheet. So that the last sync can be undone, a copy of each event as it was before that sync is kept in a hidden sheet in the same spreadsheet, replaced by the next sync and removed once you undo. Your plan status is cached in Google's per-user add-on storage. See below for how long this is kept and how to delete it; the events in your calendar stay yours.

Our licence server and payments

The same as for Calendar Timesheets above: only your Google account's email address is sent to licence.onibaku.co.uk, and we store details only if you buy Pro.

So we can tell which parts of the add-on people use and where they get stuck, the add-on also tells the licence server when you open the sidebar, preview or run a sync, reach the free plan's limit, turn on automatic form syncing, or see or click the request for a review. We store only a daily count of each, against an anonymous ID made from your email address with a one-way keyed hash. The email address itself isn't stored, and nothing about your rows, calendars or events is ever sent. These counts are deleted after 400 days.

How your data is protected

• Your spreadsheet and calendar data never leave Google. Rows are read and events written inside Google Apps Script, under your own Google account's permissions. Onibaku has no copy of them and no way to access them.
• Least access. The add-on can open the current spreadsheet only. In your calendar, it only changes events created from your spreadsheet, plus any event you point a row at. It can only read your list of calendars, not change them or their sharing.
• Encrypted in transit. The only data that leaves Google is your email address and the usage counts described above, sent over HTTPS (TLS) to our licence server. The add-on's manifest restricts it to that one address, so it can't contact any other server.
• Restricted server access. The licence server is protected as described for Calendar Timesheets above: it isn't directly exposed to the internet, only Onibaku's administrator can access it, plan checks aren't logged, and usage counts hold no email addresses.
• No card data. Card details go straight to Stripe, which is certified to PCI DSS Level 1. We never receive or store them.

How long data is kept, and how to delete it

• Your rows and calendar events: we don't keep them. They're held in memory only while a sync runs, inside Google's servers. Events created in your calendar are yours, and stay until you delete them.
• Status columns: each row's event ID and sync status are ordinary cells in your sheet. They stay until you delete them.
• Undo copy: the hidden sheet holding events as they were before the last sync is replaced at every sync and removed when you undo.
• Saved settings, automatic form syncing and cached plan status: kept in Google's add-on storage until you delete them. You can remove them at any time, together with the undo copy, with Extensions → Sheet to Calendar Sync → Delete my add-on data. The cached plan status also expires on its own after 6 hours. The backup copy used when our server is unreachable is replaced at every check and stops being used after 7 days.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections. It then stops reading or changing your calendar immediately.
• Usage counts: anonymous daily counts, deleted automatically after 400 days.
• Licence records (Pro customers only): kept and deleted as described for Calendar Timesheets above. Email admin@onibaku.co.uk to have yours deleted or anonymised sooner.

Who we share Google user data with

Your spreadsheet rows and calendar events are never shared with anyone. The only Google user data that leaves Google is your Google account's email address, and it is shared, transferred or disclosed only to:

• Onibaku's licence server (licence.onibaku.co.uk), which we run ourselves in the UK, to check your plan as described above. Its public HTTPS address is on a server hosted for us by DigitalOcean in London, which relays requests to it.
• Stripe, our payment processor, only if you choose to upgrade: your email address is passed to Stripe Checkout so it's filled in for you and the payment can be matched to your account.
• Courts, regulators or law enforcement, only if the law requires it.

If Onibaku or this add-on were ever sold or merged, we would ask for your explicit consent before any Google user data was transferred. We don't share Google user data with anyone else, including advertisers, data brokers and AI providers.

Google user data

Sheet to Calendar Sync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No third-party analytics, tracking or advertising. The anonymous usage counts above stay on our own server.
• No access to Gmail, Google Drive or your other files.
• No sale of data, and no sharing beyond what's listed under “Who we share Google user data with” above.

Heading Numbering & Table of Contents for Google Docs

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers. Your document's headings are read and numbered there. Your document text is never sent to Onibaku or anyone else.

What it accesses, and why

• The current document only (documents.currentonly): to read its headings and captions, write numbers at the start of headings and into captions, insert the captions, contents list, lists of figures and cross-references you ask for, and add the bookmarks those links point to. It can't open your other files.
• Your Google account's email address (userinfo.email): to check your plan with our licence server.
• Showing the sidebar (script.container.ui) and connecting to an external service (script.external_request): the latter is used only to contact our licence server.

What it stores

Numbers, captions, the contents list, lists of figures, cross-references and the bookmarks they link to are ordinary content in your document. Your numbering, contents and caption settings are saved in the document's add-on storage, so anyone you share the document with who also uses the add-on can see them. Your plan status and a count of numbering runs (used to decide when to ask for a review) are kept in Google's per-user add-on storage.

Our licence server and payments

The same as for Calendar Timesheets above: only your Google account's email address is sent to licence.onibaku.co.uk, and we store details only if you buy Pro or join a Team plan. For a Team plan we also store the email addresses of the people given a seat, so the buyer can see and manage them, and the buyer's email domain, so colleagues at that domain can join automatically.

So we can tell which parts of the add-on people use and where they get stuck, the add-on also tells the licence server when you open the sidebar, number or remove headings, insert a contents list or cross-reference, insert, renumber or refer to captions, insert a list of figures or tables, reach a Pro-only feature, see the upgrade options, or see or click the request for a review. We store only a daily count of each, against an anonymous ID made from your email address with a one-way keyed hash. The email address itself isn't stored, and nothing about your document or its headings is ever sent. These counts are deleted after 400 days.

How your data is protected

• Your document never leaves Google. Headings and captions are read and numbered inside Google Apps Script, under your own Google account's permissions. Onibaku has no copy of your document and no way to access it.
• Least access. The add-on can open the current document only, and only while you're using it there.
• Encrypted in transit. The only data that leaves Google is your email address and the usage counts described above, sent over HTTPS (TLS) to our licence server. The add-on's manifest restricts it to that one address, so it can't contact any other server.
• Restricted server access and no card data, as for Sheet to Calendar Sync above.

How long data is kept, and how to delete it

• Your document: we don't keep any of it. Headings are held in memory only while the add-on runs, inside Google's servers.
• Numbers, contents and references: ordinary content in your document. They stay until you delete them; Remove in the sidebar takes the numbers off.
• Saved settings, cached plan status and run count: kept in Google's add-on storage until you delete them with Extensions → Heading Numbering & Table of Contents → Delete my add-on data. The cached plan status also expires on its own after 6 hours, and the backup copy used when our server is unreachable stops being used after 7 days.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections.
• Usage counts: anonymous daily counts, deleted automatically after 400 days.
• Licence and seat records: kept and deleted as described for Calendar Timesheets above. A Team plan's buyer can remove people's seats at any time. Email admin@onibaku.co.uk to have your records deleted or anonymised sooner.

Who we share Google user data with

Your document is never shared with anyone. The only Google user data that leaves Google is your Google account's email address, and it is shared, transferred or disclosed only to:

• Onibaku's licence server (licence.onibaku.co.uk), which we run ourselves in the UK, to check your plan as described above. Its public HTTPS address is on a server hosted for us by DigitalOcean in London, which relays requests to it.
• Stripe, our payment processor, only if you choose to upgrade: your email address is passed to Stripe Checkout so it's filled in for you and the payment can be matched to your account.
• The buyer of your Team plan, only if you have a seat on it: they can see your email address in their seat list so they can manage seats.
• Courts, regulators or law enforcement, only if the law requires it.

If Onibaku or this add-on were ever sold or merged, we would ask for your explicit consent before any Google user data was transferred. We don't share Google user data with anyone else, including advertisers, data brokers and AI providers.

Google user data

Heading Numbering & Table of Contents' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No third-party analytics, tracking or advertising. The anonymous usage counts above stay on our own server.
• No access to Gmail, Google Drive or your other files.
• No sale of data, and no sharing beyond what's listed under “Who we share Google user data with” above.

Gift Aid Schedule Builder for Google Sheets

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers. Your donors' details and donations are read, checked and turned into the HMRC schedule there, and the schedule file goes straight from Google to your browser. None of your donor or donation data is ever sent to Onibaku or anyone else. The add-on doesn't send anything to HMRC: you upload the schedule yourself.

Who is responsible for donors' data

Your charity is the controller of the personal data in your spreadsheet (donors' names, addresses and gifts) and decides what to keep and for how long. The add-on only processes it inside your Google account when you use it, and Onibaku never receives it.

What it accesses, and why

• The current spreadsheet only (spreadsheets.currentonly): to set up the Donors, Donations, Small donations and Claims tabs, read your donors and donations, write the Check results, fix the formatting problems you ask it to, stamp claimed donations with their claim reference and log claims on the Claims tab. It can't open your other files.
• Your Google account's email address (userinfo.email): to check your plan with our licence server.
• Showing the sidebar (script.container.ui) and connecting to an external service (script.external_request): the latter is used only to contact our licence server.

What it stores

Check results, claim references and your claim history are ordinary cells in your spreadsheet. Your claim settings (accounting year end, schedule version and options) are saved in the spreadsheet's add-on storage, so others you share it with who also use the add-on see the same settings. Your plan status and a count of claims you've prepared (used to decide when to ask for a review) are kept in Google's per-user add-on storage.

Our licence server and payments

The same as for Calendar Timesheets above: only your Google account's email address is sent to licence.onibaku.co.uk, and we store details only if you buy Pro.

So we can tell which parts of the add-on people use and where they get stuck, the add-on also tells the licence server when you open the sidebar, check your sheets, prepare a claim, see the upgrade options, or see or answer the request for a review. We store only a daily count of each, against an anonymous ID made from your email address with a one-way keyed hash. The email address itself isn't stored, and nothing about your donors, donations or claims is ever sent. These counts are deleted after 400 days.

How your data is protected

• Donor data never leaves Google. It is processed inside Google Apps Script, under your own Google account's permissions. Onibaku has no copy of it and no way to access it.
• Least access. The add-on can open the current spreadsheet only, and only while you're using it there. It has no access to Google Drive, so it can't save files there or read them.
• Encrypted in transit. The only data that leaves Google is your email address and the usage counts described above, sent over HTTPS (TLS) to our licence server. The add-on's manifest restricts it to that one address, so it can't contact any other server.
• Restricted server access and no card data, as for Sheet to Calendar Sync above.

How long data is kept, and how to delete it

• Donor and donation data: we don't keep any of it. It's held in memory only while the add-on runs, inside Google's servers. What's in your spreadsheet is yours to keep or delete. HMRC expects charities to keep Gift Aid records for 6 years.
• Downloaded schedules: saved only where your browser puts downloads. The add-on keeps no copy and can rebuild a claim's file from your spreadsheet.
• Saved settings, cached plan status and claim count: kept in Google's add-on storage until you delete them with Extensions → Gift Aid Schedule Builder → Delete my add-on data. The cached plan status also expires on its own after 6 hours, and the backup copy used when our server is unreachable stops being used after 7 days.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections.
• Licence records: kept and deleted as described for Calendar Timesheets above. Email admin@onibaku.co.uk to have them deleted or anonymised sooner.

Who we share Google user data with

Your donor and donation data is never shared with anyone. The only Google user data that leaves Google is your Google account's email address, and it is shared, transferred or disclosed only to:

• Onibaku's licence server (licence.onibaku.co.uk), which we run ourselves in the UK, to check your plan as described above. Its public HTTPS address is on a server hosted for us by DigitalOcean in London, which relays requests to it.
• Stripe, our payment processor, only if you choose to upgrade: your email address is passed to Stripe Checkout so it's filled in for you and the payment can be matched to your account.
• Courts, regulators or law enforcement, only if the law requires it.

If Onibaku or this add-on were ever sold or merged, we would ask for your explicit consent before any Google user data was transferred. We don't share Google user data with anyone else, including advertisers, data brokers and AI providers.

Google user data

Gift Aid Schedule Builder's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No third-party analytics, tracking or advertising. The anonymous usage counts above stay on our own server.
• No access to Gmail, Google Drive or your other files.
• No sale of data, and no sharing beyond what's listed under “Who we share Google user data with” above.

Live Endnotes for Google Docs

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers. Your document's footnotes, markers and notes are read and renumbered there. Your document text is never sent to Onibaku or anyone else.

What it accesses, and why

• The current document only (documents.currentonly): to read its footnotes and notes, turn footnotes into linked markers and notes, add the notes you type, renumber and re-order markers and notes, and add the bookmarks the markers link to. It can't open your other files.
• Your Google account's email address (userinfo.email): to check your plan with our licence server.
• Showing the sidebar (script.container.ui) and connecting to an external service (script.external_request): the latter is used only to contact our licence server.

What it stores

Markers, notes, the Notes headings and the bookmarks and named ranges they use are ordinary content in your document. Your layout settings (numbering style, where notes go, section title) are saved in the document's add-on storage, so anyone you share the document with who also uses the add-on sees the same settings. Your plan status and a count of rebuilds (used to decide when to ask for a review) are kept in Google's per-user add-on storage.

Our licence server and payments

The same as for Calendar Timesheets above: only your Google account's email address is sent to licence.onibaku.co.uk, and we store details only if you buy Pro or join a Team plan. For a Team plan we also store the email addresses of the people given a seat, so the buyer can see and manage them, and the buyer's email domain, so colleagues at that domain can join automatically.

So we can tell which parts of the add-on people use and where they get stuck, the add-on also tells the licence server when you open the sidebar, convert footnotes, rebuild, add a note, see the upgrade options, or see or answer the request for a review. We store only a daily count of each, against an anonymous ID made from your email address with a one-way keyed hash. The email address itself isn't stored, and nothing from your document is ever sent. These counts are deleted after 400 days.

How your data is protected

• Your document never leaves Google. It is processed inside Google Apps Script, under your own Google account's permissions. Onibaku has no copy of your document and no way to access it.
• Least access. The add-on can open the current document only, and only while you're using it there.
• Encrypted in transit. The only data that leaves Google is your email address and the usage counts described above, sent over HTTPS (TLS) to our licence server. The add-on's manifest restricts it to that one address, so it can't contact any other server.
• Restricted server access and no card data, as for Sheet to Calendar Sync above.

How long data is kept, and how to delete it

• Your document: we don't keep any of it. Its text is held in memory only while the add-on runs, inside Google's servers.
• Markers, notes and bookmarks: ordinary content in your document. They stay until you delete them.
• Saved settings, cached plan status and rebuild count: kept in Google's add-on storage until you delete them with Extensions → Live Endnotes → Delete my add-on data. The cached plan status also expires on its own after 6 hours, and the backup copy used when our server is unreachable stops being used after 7 days.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections.
• Licence and seat records: kept and deleted as described for Calendar Timesheets above. A Team plan's buyer can remove people's seats at any time. Email admin@onibaku.co.uk to have your records deleted or anonymised sooner.

Who we share Google user data with

Your document is never shared with anyone. The only Google user data that leaves Google is your Google account's email address, and it is shared, transferred or disclosed only to:

• Onibaku's licence server (licence.onibaku.co.uk), which we run ourselves in the UK, to check your plan as described above. Its public HTTPS address is on a server hosted for us by DigitalOcean in London, which relays requests to it.
• Stripe, our payment processor, only if you choose to upgrade: your email address is passed to Stripe Checkout so it's filled in for you and the payment can be matched to your account.
• The buyer of your Team plan, only if you have a seat on it: they can see your email address in their seat list so they can manage seats.
• Courts, regulators or law enforcement, only if the law requires it.

If Onibaku or this add-on were ever sold or merged, we would ask for your explicit consent before any Google user data was transferred. We don't share Google user data with anyone else, including advertisers, data brokers and AI providers.

Google user data

Live Endnotes' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No third-party analytics, tracking or advertising. The anonymous usage counts above stay on our own server.
• No access to Gmail, Google Drive or your other files.
• No sale of data, and no sharing beyond what's listed under “Who we share Google user data with” above.

Statbench for Google Sheets

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers. The ranges you choose are read and the result tables are worked out there. Your spreadsheet data is never sent to Onibaku or anyone else.

What it accesses, and why

• The current spreadsheet only (spreadsheets.currentonly): to read the ranges you pick, write result tables and charts to a new sheet or the cell you choose, and, for Goal Seek, Data Tables and Solver, set the input cells you name and read the results. It can't open your other files.
• Your Google account's email address (userinfo.email): to check your plan with our licence server.
• Showing the sidebar (script.container.ui) and connecting to an external service (script.external_request): the latter is used only to contact our licence server.

What it stores

Result sheets are ordinary content in your spreadsheet. The ranges and options each tool last used are saved in the spreadsheet's add-on storage, so anyone you share the spreadsheet with who also uses the add-on sees the same settings. Your plan status and a count of runs (used to decide when to ask for a review) are kept in Google's per-user add-on storage.

Our licence server and payments

The same as for Calendar Timesheets above: only your Google account's email address is sent to licence.onibaku.co.uk, and we store details only if you buy Pro or join a class or team licence. For a class or team licence we also store the email addresses of the people given a seat, so the buyer can see and manage them, and the buyer's email domain, so people at that domain can join automatically.

So we can tell which tools people use and where they get stuck, the add-on also tells the licence server when you open the sidebar, run a tool (and which one), see the upgrade options, or see or answer the request for a review. We store only a daily count of each, against an anonymous ID made from your email address with a one-way keyed hash. The email address itself isn't stored, and nothing from your spreadsheet is ever sent. These counts are deleted after 400 days.

How your data is protected

• Your spreadsheet never leaves Google. It is processed inside Google Apps Script, under your own Google account's permissions. Onibaku has no copy of your data and no way to access it.
• Least access. The add-on can open the current spreadsheet only, and only while you're using it there.
• Encrypted in transit. The only data that leaves Google is your email address and the usage counts described above, sent over HTTPS (TLS) to our licence server. The add-on's manifest restricts it to that one address, so it can't contact any other server.
• Restricted server access and no card data, as for Sheet to Calendar Sync above.

How long data is kept, and how to delete it

• Your spreadsheet data: we don't keep any of it. It is held in memory only while a tool runs, inside Google's servers.
• Result sheets: ordinary content in your spreadsheet. They stay until you delete them.
• Saved settings, cached plan status and run count: kept in Google's add-on storage until you delete them with Extensions → Statbench → Delete my add-on data. The cached plan status also expires on its own after 6 hours, and the backup copy used when our server is unreachable stops being used after 7 days.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections.
• Licence and seat records: kept and deleted as described for Calendar Timesheets above. A class or team licence's buyer can remove people's seats at any time. Email admin@onibaku.co.uk to have your records deleted or anonymised sooner.

Who we share Google user data with

Your spreadsheet data is never shared with anyone. The only Google user data that leaves Google is your Google account's email address, and it is shared, transferred or disclosed only to:

• Onibaku's licence server (licence.onibaku.co.uk), which we run ourselves in the UK, to check your plan as described above. Its public HTTPS address is on a server hosted for us by DigitalOcean in London, which relays requests to it.
• Stripe, our payment processor, only if you choose to upgrade: your email address is passed to Stripe Checkout so it's filled in for you and the payment can be matched to your account.
• The buyer of your class or team licence, only if you have a seat on it: they can see your email address in their seat list so they can manage seats.
• Courts, regulators or law enforcement, only if the law requires it.

If Onibaku or this add-on were ever sold or merged, we would ask for your explicit consent before any Google user data was transferred. We don't share Google user data with anyone else, including advertisers, data brokers and AI providers.

Google user data

Statbench's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No third-party analytics, tracking or advertising. The anonymous usage counts above stay on our own server.
• No access to Gmail, Google Drive or your other files.
• No sale of data, and no sharing beyond what's listed under “Who we share Google user data with” above.

Sort Paragraphs & Sections for Google Docs

Where it runs

The add-on is built with Google Apps Script and runs on Google's servers, under your own Google account. Your document is sorted there, and its text is never sent to Onibaku or anyone else.

What it accesses, and why

• The current document only (documents.currentonly): to read the paragraphs and headings you sort, move them into the new order and remove the duplicates you ask it to. It can't open your other files.

That is its only permission. It can't show a sidebar, read your email address or connect to any server, ours included.

What it stores

Nothing. The sorted paragraphs are ordinary content in your document. The add-on keeps no settings, no history and no copy of your text, and it has no licence check or usage counts.

How your data is protected

• Your document never leaves Google. Paragraphs are read and moved inside Google Apps Script. Onibaku has no copy of your document and no way to access it.
• Least access. The add-on can open the current document only, and only while you're using it there.
• No network access. Without the permission to make external requests, the add-on can't send data anywhere.

How long data is kept, and how to delete it

• Your document: we don't keep any of it. Paragraphs are held in memory only while a sort runs, inside Google's servers.
• Access to your Google account: you can remove the add-on's access at any time at myaccount.google.com/connections, or uninstall it from Extensions → Add-ons → Manage add-ons.

Who we share Google user data with

No one. The add-on has no network access, so your document never leaves Google and no Google user data is shared, transferred or disclosed to Onibaku or anyone else.

Google user data

Sort Paragraphs & Sections' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to sort the document you ask it to. It is never stored, sold, used for advertising or used to train AI or machine learning models, and no human at Onibaku sees it.

What it doesn't do

• No analytics, tracking, advertising or usage counts.
• No access to Gmail, Google Drive, your email address or your other files.
• No connection to our servers or anyone else's.

Onibaku Sheets Sync for HubSpot

Where it runs

Unlike our other apps, Sheets Sync runs on our own server (sheets.onibaku.co.uk, hosted by DigitalOcean in the UK), because HubSpot sends workflow actions to it as they happen. When a workflow runs the action, our server reads the enrolled record from HubSpot and writes a row to the Google Sheet you chose.

What it accesses in HubSpot, and why

• Contacts, companies, deals and tickets, read-only (crm.objects.*.read), and custom objects if you allow them: the properties of the record a workflow sends, limited to the properties your sheet's column headings ask for.
• Owners, read-only (crm.objects.owners.read): to show owners' names instead of IDs.
• Workflows (automation): to receive workflow actions, report each run's result back to HubSpot, and read property and pipeline labels.
• Account details (oauth): your HubSpot account ID, time zone and currency, so dates are written in your time zone, and the email of the person who installed the app, for failure alerts and billing.

The app can't create, change or delete anything in HubSpot.

What it accesses in Google, and why

• Only the spreadsheets you pick (drive.file): the app can open just the files you choose with Google's file picker, to read their tab names and heading row and to write rows. It can't see the rest of your Drive.
• Your Google account's email address (email, openid): to show which Google account is connected.

What it stores

• For each HubSpot account: its ID, UI domain, time zone and currency, the installer's email, and HubSpot access and refresh tokens.
• The connected Google account's email and Google access and refresh tokens.
• The spreadsheets you've added (ID and title) and any column choices you've changed.
• An activity log of workflow runs: when, which record (type and ID only), which spreadsheet, the result, the row number and any error message. Record contents aren't stored; they pass through on their way to your sheet.

All tokens are encrypted at rest with AES-256-GCM, using a key kept separately from the database and its backups. The database is backed up daily, and backups are kept for 7 days. When you disconnect, tokens, spreadsheets and column choices are deleted straight away (within an hour if you uninstall from HubSpot's settings instead); activity log entries are deleted after 30 days.

Our licence server and payments

To check the plan, the app sends your HubSpot account ID, and the installer's email to pre-fill checkout, to licence.onibaku.co.uk. If you buy Pro, we store the HubSpot account ID, a licence key, your Stripe customer and subscription IDs and your subscription status, and keep them as described for Calendar Timesheets above. Payments are processed by Stripe.

Google user data

Onibaku Sheets Sync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the app's features to you. It is never sold, never used for advertising, never used to train AI or machine learning models, and no human at Onibaku reads it unless you ask us to for support, it's needed for security, or the law requires it.

What it doesn't do

• No analytics, tracking or advertising.
• No access to Gmail or to Drive files you haven't picked.
• No sale or sharing of data with third parties, apart from Stripe for payments and Resend for alert emails.

Social Media Comment Generator (Chrome extension)

Where it runs

The extension runs in your browser on linkedin.com, facebook.com, x.com and youtube.com. Drafts are written by our server (li.freemobilelottery.org, hosted by DigitalOcean in the UK), which uses OpenAI's API.

What it reads, and why

• Only the post you click "Generate" on: its text (for a reply, the post and the comment you're replying to; on YouTube, the video's title, channel and description). This is sent to our server and on to OpenAI to write the draft. Nothing is read from pages you don't press the button on.
• Your email address, from ExtensionPay when you start a trial or subscribe, to link your account to your subscription.

The extension can't post, like or message on your behalf, and doesn't read your messages, contacts or browsing history.

What it stores

• On our server: your email, your plan, how many comments you've generated this period, and the post text and drafts you've generated. Post text and drafts are deleted automatically after 90 days.
• In your browser: a sign-in token, your ExtensionPay key and which sites you've switched on.

OpenAI

Post text is sent to OpenAI only to write your draft. Under OpenAI's API terms it isn't used to train their models, and OpenAI may keep it for up to 30 days to monitor abuse.

Payments

Trials and subscriptions are handled by ExtensionPay, with payment processed by Stripe. We never see your card details.

What it doesn't do

• No analytics, tracking or advertising.
• No sale or sharing of data with third parties, apart from OpenAI to write drafts and ExtensionPay and Stripe for payments.

Curtain Twitcher (Chrome and Firefox extension)

Where it runs

The extension runs in your browser on the supported property portals: rightmove.co.uk, onthemarket.com (from version 0.4) and zoopla.co.uk (from version 0.7). It talks to our server (twitcher.onibaku.co.uk, run by us in the UK), never to anywhere else from your browser, and never loads pages from the property portals itself.

Without your consent

When you open a listing or search page, the extension reads the facts on that page and sends a lookup to our server so it can show you price history, sold prices, EPC information and demand figures. A listing lookup contains the listing ID, postcode, map pin and the few details needed to match the home to open data (property type, beds, size, price and the portal's delivery point ID), plus the listing's earlier asking prices by month where the portal's page shows them (Zoopla's property timeline). A search lookup contains the listing IDs, prices and basic details on the page. Unless you opt in to community data, we don't store these lookups or link them to your install.

Install ID

On installation the extension creates a random identifier. We store it only in hashed form. It isn't linked to your name or email unless you buy a buying pass, and "Delete my data" replaces it.

On your device

From version 0.5, the extension keeps the details it showed for the last 40 listings you opened (for up to 180 days) in your browser's storage, so the home summary and comparison pages work without looking them up again. They never leave your device, and "Delete my data" clears them.

Breakage reports

If a portal page doesn't read the way the extension expects, usually because the portal has changed its pages, the extension tells our server which check failed: the portal, the kind of page (listing or search), the name of the check and the extension version. The report doesn't include the listing, its address or price, the page address, your install ID or anything else about you, and each kind is sent at most once a day. We keep only hourly counts, for 90 days, to spot breakage and fix it. On Firefox you can turn these off by switching off technical and interaction data in the add-on's settings.

Community data (optional)

If you tick the box on the welcome page or in the popup, the extension also sends:

• Listing facts: ID, price, price qualifier, status or update reason, first visible date, beds, baths, type and subtype, tenure, lease years, size, council tax band, service charge, ground rent, postcode, latitude and longitude, branch ID, delivery point ID and nearest stations, and the portal's own timeline of the listing's asking prices by month where it shows one.
• Your search criteria on the portal: location ID and name, minimum and maximum price, beds, type, radius, must-haves and don't-shows, sort order and result count.
• The IDs of listings you view.

We use this to build listing price histories and the postcode demand gauge, and to power features for you such as recently viewed listings, "new since your last visit" and better ranking. It's linked to your install ID, kept as raw events for 24 months and then folded into aggregate figures. Demand figures are only shown inside the extension, grouped by postcode district, and hidden where there are fewer than 10 searches. This covers Rightmove, OnTheMarket and Zoopla alike (OnTheMarket and Zoopla from 23 October 2026).

The same home on other portals

To show a home's other listings (on another portal, or an earlier listing it was relisted from), we link stored listings that are the same home: by the delivery point, by the energy certificate we're sure belongs to the home (we store that home's property reference, the UPRN, against the listing for this), or by the postcode, property type, bedrooms, asking price and map pin together. This uses listing facts only, never anything about who looked at them, and a lookup without community data is compared with what's stored and then dropped.

Never collected

Photos, floorplans, listing descriptions or key-features text, agent contact details, anything from websites other than the supported property portals, and names or email addresses (except the email you give us for a buying pass).

Buying pass

If you buy a pass we store your email address to link the pass to your install, to send sign-in links and to send the price and status alerts you ask for. Your watchlist and notes are stored on our server so alerts work. Payments are processed by Stripe; we never see your card details. Emails are sent through Resend.

TypeSafe (AI)

Our server, not your browser, uses TypeSafe's AI model, Jev, for two jobs:

• Matching a listing to its energy certificate. We send the listing's postcode, property type and subtype, beds, size and price band, plus the candidate energy certificates for that postcode from the public EPC register: their address lines, rating, type, built form, floor area, rooms and distance from the listing's map pin.
• "Match my brief" (buying pass). We send your brief, the name of the area you searched and, for each listing on the page, its type, beds, price, size, tenure, EPC band, postcode district and town or suburb, plus our own figures: distance to the nearest station, distance from the middle of the searched area and price per square foot against local sales. The street and house are removed from listing addresses before anything reaches our server. Your brief and the scores aren't stored.

We never send TypeSafe your install ID, email address, IP address, search history or anything else that identifies you. We keep the answer to each matching request (the listing ID, the certificate chosen and how confident it was) so the same listing isn't sent twice. That record holds nothing about you and is deleted after 24 months.

Open data

Sold prices, EPC and location data come from HM Land Registry, the energy performance certificate register and Ordnance Survey under the Open Government Licence v3.0. Address-level EPC data is personal data; we process it under legitimate interests to provide property information, and apply the register's removals. Area information (local price changes, council tax and rents, flood risk, crime, deprivation, census and broadband figures, schools, GP practices and stations nearby, planning constraints and ground hazards) comes from public bodies' open data, also under the Open Government Licence. It describes places, not people, and is looked up from the listing's postcode and map pin; nothing about you is sent to those bodies.

What it doesn't do

• No analytics, tracking or advertising.
• No sale or sharing of data with advertisers, data brokers or anyone else, including in aggregated or anonymised form. Only Stripe, Resend and TypeSafe process data on our behalf, as described above.
• You can turn community data off at any time in the popup; anything not yet sent is discarded. "Delete my data" deletes the events, watchlist and email link held for your install.

ChatBundle (web app)

Where it runs

ChatBundle is a web page at chatbundle.onibaku.co.uk. The WhatsApp export you open is read, filtered and turned into a PDF by code running in your own browser. Your chat, its attachments and the PDF are processed in your browser and never uploaded: not to us, not to anyone. The page's security policy only allows it to contact its own web server, our licence server and our page-count server.

What it accesses, and why

Only the file you choose or drop onto the page, and only to show you the preview and build your PDF. To draw the PDF in scripts such as Arabic, Chinese or Hindi, the page downloads the matching font file from its own server; that request says which font is needed, nothing else about the chat.

What it stores

Nothing from your chat. In your browser's local storage it keeps a random ID for the browser, your licence key if you have one, and the licence server's last answer about that key, so a short outage doesn't lock you out. Closing the tab removes the chat from ChatBundle.

Our licence server and payments

When you check a key, buy a pass or use the app, the page sends our licence server (licence.onibaku.co.uk, run by us) the browser's random ID, your licence key if you have one, and anonymous event names (opened a file, made a free PDF, made a full PDF, clicked buy) so we can count how the app is used. These counts are stored against a one-way hash of the random ID, not the ID itself, and deleted after 400 days. Payments are processed by Stripe, which collects your email address and card details; we receive your email address to send and recover your licence key, and never see your card. Key recovery emails are sent through Resend.

Page counts

The page records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and three funnel steps (file opened, preview shown, checkout clicked). It sets no cookies, stores nothing in your browser and doesn't keep IP addresses. Nothing from your chat is included.

How your data is protected

Your chat never leaves your device, so there is nothing of it for us to protect or lose. The page is served over HTTPS with a strict content security policy, and the licence server only accepts requests from ChatBundle's own address.

How long data is kept, and how to delete it

Licence and purchase records are kept while your pass is active and for six years afterwards for tax records. Usage counts are deleted after 400 days. To clear what's in your browser, clear this site's data in your browser settings. To have your purchase records deleted (where the law allows), email admin@onibaku.co.uk.

What it doesn't do

• No upload of chats, attachments or PDFs, ever.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone. Only Stripe and Resend process data on our behalf, as described above.

Executor’s Cashbook (web app)

Where it runs

Executor’s Cashbook is a web page at cashbook.onibaku.co.uk. Everything you enter about an estate (names, dates, addresses, National Insurance numbers, assets, debts, payments, beneficiaries and letters) is stored in your own browser on your device, using its built-in storage, and the accounts and letters are made there too. Estate data stays on your device: it is never sent to us or anyone else. The page’s security policy only allows it to contact its own web server, our licence server and our page-count server.

What it accesses, and why

Only what you type in, and any backup file you choose to open, to show and update your records and make your PDFs. When you make a PDF, the page downloads its font files from its own server; that request carries nothing about the estate.

What it stores

In your browser: your estates, and for each one its licence key if it has a pass. In local storage: a random ID for the browser and the licence server’s last answer about each key, so a short outage doesn’t lock you out. Files you export are saved where you choose; encrypted copies can only be opened with the passphrase you set, which we never see.

Our licence server and payments

When you check a key, buy or renew a pass, or use the app, the page sends our licence server (licence.onibaku.co.uk, run by us) the browser’s random ID, the estate’s licence key if it has one, and anonymous event names (opened the app, added an item, viewed the accounts, made a PDF, clicked buy) so we can count how the app is used. These counts are stored against a one-way hash of the random ID, not the ID itself, and deleted after 400 days. Payments are processed by Stripe, which collects your email address and card details; we receive your email address to send and recover your licence key, and never see your card. Key recovery emails are sent through Resend. Nothing about the estate is ever sent.

Page counts

The site records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and funnel steps (first asset added, accounts viewed, checkout clicked, calculator used). It sets no cookies, stores nothing in your browser and doesn’t keep IP addresses. Nothing you type is included.

How your data is protected

Estate data never leaves your device unless you export it, so there is nothing of it on our side to protect or lose. Anyone who can use your browser profile can open the app and see your estates, so keep your device locked. Exports with a passphrase are encrypted with AES-256-GCM using a key derived from the passphrase (PBKDF2, 600,000 rounds); exports without one are plain files, and the app says so. The page is served over HTTPS with a strict content security policy, and the licence server only accepts requests from the app’s own address.

How long data is kept, and how to delete it

Your estates stay in your browser until you delete them (“Share and back up”, then “Delete this estate”) or clear this site’s data in your browser settings. Licence and purchase records are kept while a pass is active and for six years afterwards for tax records. Usage counts are deleted after 400 days. To have your purchase records deleted (where the law allows), email admin@onibaku.co.uk.

What it doesn’t do

• No upload of estate records, letters or accounts, ever.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone. Only Stripe and Resend process data on our behalf, as described above.

AwardMatch (web app)

Where it runs

AwardMatch is a web page at awardmatch.onibaku.co.uk. Everything you enter (award details, the support worker’s invoice details including their UTR and bank details, sessions, sign-offs and signatures, taxi receipts and claims) is stored in your own browser on your device, using its built-in storage, and invoices and calendar files are made there too. Claim data stays on your device: it is never sent to us or anyone else. The page’s security policy only allows it to contact its own web server, our licence server and our page-count server.

What it accesses, and why

Only what you type in or draw (signatures), any logo you choose for invoices, and any backup file you open, to show and update your records and make your PDFs. When you make a PDF, the page downloads its fonts and PDF code from its own server; those requests carry nothing you entered.

No special-category data

AwardMatch has no field for anyone’s health, condition or disability, and its examples describe the work, not the person. It doesn’t need to know why someone has an Access to Work award. Free-text fields (like session descriptions) are yours, and stay on your device.

What it stores

In your browser: your awards and everything in them, and your settings and invoice branding. In local storage: your Worker Pro licence key if you have one, a random ID for the browser, the licence server’s last answer about the key (so a short outage doesn’t lock you out), and the date of the last weekly usage count. Files you export are saved where you choose; encrypted copies can only be opened with the passphrase you set, which we never see.

Our licence server and payments

When you check a key, subscribe, or use the app, the page sends our licence server (licence.onibaku.co.uk, run by us) the browser’s random ID, your licence key if you have one, and anonymous event names (opened the app, added an award, made a first invoice, clicked buy, and a weekly “active” count so we know how many people use the free version). These counts are stored against a one-way hash of the random ID, not the ID itself, and deleted after 400 days. Subscriptions are processed by Stripe, which collects your email address and card details; we receive your email address to send and recover your licence key, and Stripe’s billing portal lets you cancel. We never see your card. Key recovery emails are sent through Resend. Nothing about your award, sessions or claims is ever sent.

Page counts

The site records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and funnel steps (award added, first invoice, checkout clicked, free template used). It sets no cookies, stores nothing in your browser and doesn’t keep IP addresses. Nothing you type is included.

How your data is protected

Claim data never leaves your device unless you export it, so there is nothing of it on our side to protect or lose. Anyone who can use your browser profile can open the app and see your records, so keep your device locked. Exports with a passphrase are encrypted with AES-256-GCM using a key derived from the passphrase (PBKDF2, 600,000 rounds); exports without one are plain files, and the app says so. The page is served over HTTPS with a strict content security policy, and the licence server only accepts requests from the app’s own address.

How long data is kept, and how to delete it

Your records stay in your browser until you delete them (“Award details”, then “Delete award”) or clear this site’s data in your browser settings. Licence and purchase records are kept while a subscription is active and for six years afterwards for tax records. Usage counts are deleted after 400 days. To have your purchase records deleted (where the law allows), email admin@onibaku.co.uk.

What it doesn’t do

• No upload of awards, sessions, signatures, invoices or claims, ever.
• No submitting anything to DWP or Access to Work. You make claims yourself.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone. Only Stripe and Resend process data on our behalf, as described above.

Research Trail (web app)

Where it runs

Research Trail is a web page at researchtrail.onibaku.co.uk. Everything you enter (research objectives, log entries, sources, clients, rates and time) is stored in your own browser on your device, using its built-in storage, and reports, calendars and time summaries are made there too. Your research stays on your device: it is never sent to us or anyone else. The page’s security policy only allows it to contact its own web server, our licence server and our page-count server.

What it accesses, and why

Only what you type in and any backup file you open, to show and update your log and make your documents. When you make a document, the page downloads its fonts and Word or PDF code from its own server; those requests carry nothing you entered.

What it stores

In your browser: your objectives, log entries, sources, clients and time, and your settings (researcher name, paper size, last backup date). In local storage: your Pro licence key if you have one, a random ID for the browser, the licence server’s last answer about the key (so a short outage doesn’t lock you out), your choice of pounds or dollars, and the date of the last weekly usage count. Backup files you download are saved where you choose and aren’t encrypted, so keep them somewhere private.

Our licence server and payments

When you check a key, subscribe, or use the app, the page sends our licence server (licence.onibaku.co.uk, run by us) the browser’s random ID, your licence key if you have one, the plan and currency you choose, and anonymous event names (opened the app, created an objective, made a first report, clicked buy, and a weekly “active” count so we know how many people use the free version). These counts are stored against a one-way hash of the random ID, not the ID itself, and deleted after 400 days. Subscriptions are processed by Stripe, which collects your email address and card details; we receive your email address to send and recover your licence key, and Stripe’s billing portal lets you cancel. We never see your card. Key recovery emails are sent through Resend. Nothing from your research is ever sent.

Page counts

The site records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and funnel steps (objective created, first report, checkout clicked, free template used). It sets no cookies, stores nothing in your browser and doesn’t keep IP addresses. Nothing you type is included.

How your data is protected

Your research never leaves your device unless you download a backup or a document, so there is nothing of it on our side to protect or lose. Anyone who can use your browser profile can open the app and see your log, so keep your device locked. The page is served over HTTPS with a strict content security policy, and the licence server only accepts requests from the app’s own address.

How long data is kept, and how to delete it

Your research stays in your browser until you delete it (an objective’s “Details”, then “Delete objective”) or clear this site’s data in your browser settings. Licence and purchase records are kept while a subscription is active and for six years afterwards for tax records. Usage counts are deleted after 400 days. To have your purchase records deleted (where the law allows), email admin@onibaku.co.uk.

What it doesn’t do

• No upload of objectives, searches, sources, clients or time, ever.
• No connection to FamilySearch, Ancestry or any other genealogy site.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone. Only Stripe and Resend process data on our behalf, as described above.

Flossmark (web app)

Where it runs

Flossmark is a web page at flossmark.onibaku.co.uk. When you import a chart, the PDF is read inside your own browser on your device; the chart, the original PDF and your progress are stored in your browser’s built-in storage. Your charts stay on your device: they are never sent to us or anyone else. The page’s security policy only allows it to contact its own web server, our licence server and our page-count server.

What it accesses, and why

Only the PDF files and backup files you choose to open, to read the chart and show your progress. It doesn’t use your camera, location, contacts or any other files.

What it stores

In your browser: each imported chart (its squares, threads and small pictures of its symbols), the original PDF, and which stitches you’ve marked. In local storage: your view settings, your licence key if you have one, a random ID for the browser, the licence server’s last answer about the key (so a short outage or being offline doesn’t lock you out), and the date of the last weekly usage count. Backup files you download are saved where you choose and aren’t encrypted.

Our licence server and payments

When you check a key, buy, or use the app, the page sends our licence server (licence.onibaku.co.uk, run by us) the browser’s random ID, your licence key if you have one, and anonymous event names (opened the app, imported a chart, an import failed, marked a first stitch, opened the sample, clicked buy, and a weekly “active” count so we know how many people use the free version). If an import fails and you choose to send a report, the event also names the program that made the PDF (for example “PCStitch”) and its page count, never the chart itself. These counts are stored against a one-way hash of the random ID, not the ID itself, and deleted after 400 days. The lifetime unlock is processed by Stripe, which collects your email address and card details; we receive your email address to send and recover your licence key. We never see your card. Key recovery emails are sent through Resend.

Page counts

The site records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and funnel steps (chart imported, import failed, first stitch marked, checkout clicked, and, only if you send the report, the PDF’s creator program and page count). It sets no cookies, stores nothing in your browser and doesn’t keep IP addresses.

How your data is protected

Your charts never leave your device unless you download a backup, so there is nothing of them on our side to protect or lose. Anyone who can use your browser profile can open the app and see your charts, so keep your device locked. The page is served over HTTPS with a strict content security policy, and the licence server only accepts requests from the app’s own address.

How long data is kept, and how to delete it

Charts and progress stay in your browser until you delete them (“Delete” on the chart list) or clear this site’s data in your browser settings. Purchase records are kept for six years for tax records. Usage counts are deleted after 400 days. To have your purchase records deleted (where the law allows), email admin@onibaku.co.uk.

What it doesn’t do

• No upload of charts, PDFs or progress, ever.
• No connection to Etsy, designers’ shops or any other site.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone. Only Stripe and Resend process data on our behalf, as described above.

Beginners Call (web app)

Where it runs

Beginners Call is a web page at beginnerscall.onibaku.co.uk. The checker works inside your own browser: the show dates, children’s names and performance days you type are worked out on your device and never sent to us or anyone else. The page’s security policy only allows it to contact its own web server and our page-count server.

What it stores

In your browser’s local storage: the show and cast you last entered, so they’re still there next time and can fill in the printable sheets. Clear this site’s data in your browser settings to remove them. Use initials rather than full names if you share the device.

The email list

If you join the list for the fuller kit, we store your email address, the role you picked and the page you signed up on, in a file on our own web server. We use it only to email you once about the kit, or not at all if it isn’t built, and delete the list once that’s done. To be removed sooner, email admin@onibaku.co.uk.

Page counts

The site records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and two events (a check was run, the sign-up form was sent), never anything you typed. It sets no cookies and doesn’t keep IP addresses.

What it doesn’t do

• No upload of children’s names, dates or anything else you type into the checker.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone.

Brought Forward (web app)

Where it runs

Brought Forward is a web page at statements.onibaku.co.uk. When you choose a bank statement PDF, it is read inside your own browser on your device. Your statements are never sent to us or anyone else, and nothing from them is kept after you close the page. The page’s security policy only allows it to contact its own web server, our licence server and our page-count server.

What it accesses, and why

Only the PDF you choose, to read its transactions, check them against the running balance and make the file you download. If a PDF has a password, the password you type is used only to open it in your browser. It doesn’t use your camera, location, contacts or any other files.

What it stores

In local storage: the download format you last chose, your licence key if you have one, a random ID for the browser, the licence server’s last answer about the key (so a short outage doesn’t lock you out), the date of the last weekly usage count, and, for the free allowance, today’s date with a fingerprint of each statement converted today (its bank, period, number of rows and net total, never its transactions). Files you download are saved where you choose.

Our licence server and payments

When you check a key, buy, or use the app, the page sends our licence server (licence.onibaku.co.uk, run by us) the browser’s random ID, your licence key if you have one, and anonymous event names (opened the page, read a statement, a statement was flagged or couldn’t be read, downloaded a format, reached the free limit, clicked buy, and a weekly “active” count). If a statement doesn’t read cleanly and you choose to send a report, the event names the bank (for example “HSBC”) and nothing else. These counts are stored against a one-way hash of the random ID, not the ID itself, and deleted after 400 days. Pro subscriptions are processed by Stripe, which collects your email address and card details; we receive your email address to send and recover your licence key. We never see your card. Key recovery emails are sent through Resend.

Page counts

The site records visits in our own GoatCounter at stats.onibaku.co.uk: the page address, the referring site, your screen width, and funnel steps (statement chosen, statement read, file downloaded, checkout clicked, and, only if you send the report, the bank’s name). It sets no cookies, stores nothing in your browser and doesn’t keep IP addresses.

How your data is protected

Your statements never leave your device, so there is nothing of them on our side to protect or lose. The page is served over HTTPS with a strict content security policy, and the licence server only accepts requests from the app’s own address.

How long data is kept, and how to delete it

Nothing from a statement is kept once you close or leave the page. Settings and your key stay in your browser until you clear this site’s data. Purchase records are kept for six years for tax records. Usage counts are deleted after 400 days. To have your purchase records deleted (where the law allows), email admin@onibaku.co.uk.

What it doesn’t do

• No upload of statements or transactions, ever.
• No connection to your bank or your accounting software.
• No cookies, advertising or third-party trackers.
• No sale or sharing of data with anyone. Only Stripe and Resend process data on our behalf, as described above.

Earful (web app and Companion extension)

Where it runs

Earful is a web app at earful.onibaku.co.uk, run by us on our own server, plus the optional Earful Companion browser extension for Chrome and Firefox. Your account, the businesses you add, their reviews, your drafts and replies, and your settings are stored on our server. The Companion runs in your own browser.

What it accesses, and why

• Your email address, to sign you in with an emailed link and to send the alerts and receipts you ask for.
• Public reviews of the businesses and apps you add, from the review pages you give us, so they can be shown in your inbox. We collect App Store, Google Play, Feefo and REVIEWS.io reviews ourselves, on our server; when Apple’s public review feed comes back empty for an app, its App Store reviews come from DataForSEO instead. Google, Tripadvisor and Trustpilot reviews come either from DataForSEO, a data provider that reads those public pages for us, or through the Companion. Booking.com reviews come only through the Companion.
• The Earful Companion, if you install it, has access only to Earful, to Google, Tripadvisor, Trustpilot, Booking.com and Yelp pages, and to the restaurant partner dashboards of Deliveroo, Just Eat, Uber Eats, OpenTable, DoorDash and Grubhub. It reads those review pages and owner dashboards while you have them open, and sends Earful the reviews it finds for the businesses you’ve added. When you press “Copy and open reply page” in Earful, it fills your reply into that site’s reply box; it never presses submit, and tells Earful once you have. If a review page it recognises stops giving reviews, it tells Earful the site and its own version number, nothing else. It doesn’t read other sites, your passwords, or anything else in your browser.
• App Store Connect API keys and Google Play service account keys you upload, used only to read your app reviews and post the replies you send.
• Slack and webhook addresses you add for alerts. Earful posts alert messages to them and nothing else; a Slack incoming webhook can only post to its one channel, so we can’t read your Slack.
• Reviews, your tone settings and a few of your earlier replies are sent to Anthropic (the Claude API) when you press Draft, to write the reply. Anthropic doesn’t use API data to train its models.

What it stores

On our server: your email address, your businesses and their review page links, the reviews collected for them, your drafts and sent replies, alert settings, and your developer keys and alert addresses, which are encrypted. In your browser: a sign-in cookie, needed to keep you signed in. The Companion stores, in the extension’s own storage, a sign-in token for your Earful account, the review pages you’ve added, which reviews it has already sent, and how many it has synced per site.

Our licence server and payments

Paid plans are bought through our licence server (licence.onibaku.co.uk, run by us), which records your email address, plan, number of locations and licence key. Payments are processed by Stripe, which collects your email address and card details; we never see your card. Sign-in links, alerts and receipts are sent through Resend.

So we can see where people get stuck, Earful also tells the licence server when a workspace signs up, adds its first review page, creates its first API key and records its first reply, and once on each day it’s used; the licence server counts it when you open an upgrade link. It sends the workspace owner’s email address, which the licence server turns into an anonymous ID with a one-way keyed hash and doesn’t store. Only a daily count of each is kept, against that ID, and deleted after 400 days. Nothing about your businesses, reviews or replies is sent.

Page counts

Earful has no analytics or tracking scripts. If we add page counts, they’ll go to our own GoatCounter at stats.onibaku.co.uk, with no cookies and no IP addresses kept, and this section will say so first.

How your data is protected

The app is served only over HTTPS. Developer keys and alert addresses are encrypted at rest with AES-256-GCM, and are only decrypted to make the requests you ask for. Nightly backups of the database are encrypted. Sign-in uses single-use emailed links that expire, so there are no passwords to leak. The Companion only talks to Earful, using the token you paired it with. Only Onibaku can reach the server.

How long data is kept, and how to delete it

Your account and everything in it is kept while you use Earful. Delete a location or a review page in Earful to remove its reviews and drafts straight away, and remove keys, tokens and alerts from Settings and Alerts the same way. To delete your whole account, write to admin@onibaku.co.uk from its address: we remove everything within 7 days, and from backups within 30 days. Disconnecting the Companion, or removing it from your browser, deletes what it stores. Purchase records are kept for six years for tax records.

Who we share data with

Only these processors, each for the job described above: DataForSEO (reading public Google, Tripadvisor, Trustpilot and App Store reviews), Anthropic (drafting replies), Slack (alerts you turn on), Resend (email) and Stripe (payments). We don’t sell data or share it with anyone else.

What it doesn’t do

• No posting without you: every reply is sent or submitted by you pressing the button.
• No reading of your browsing beyond the review pages of the businesses you’ve added.
• No advertising or third-party trackers.
• No sale or sharing of data beyond the processors named above.

Tellstack (web app, API and the TellstackBot crawler)

Where it runs

Tellstack is a web app and API at tellstack.onibaku.co.uk, run by us on our own server. Your account, API keys, bulk jobs, watches and webhooks are stored there, along with the index: what technology each website we’ve scanned is built with, and how that has changed.

What it accesses, and why

• Your email address, to sign you in with an emailed link and to check your plan.
• The domains you send us in a lookup, a bulk job or a watch, to scan them and give you the answer. A domain you look up joins our index, so its technology can show on its public page (below). The index never records who asked about a site.
• Webhook addresses you add. We post the events you choose to them, signed with a secret we keep for that purpose.

The crawler and the index

To build the index, our crawler, TellstackBot, visits public websites. It identifies itself as Mozilla/5.0 (compatible; TellstackBot/1.0; +https://tellstack.onibaku.co.uk/bot; admin@onibaku.co.uk).

• What it fetches: a site’s robots.txt, then its homepage and at most two other pages linked from it, about once a month, or sooner when a customer looks the site up or watches it. It also looks up the site’s public DNS records (NS, MX, TXT, SOA and the www CNAME) and notes who issued its TLS certificate.
• How it behaves: it reads robots.txt first and obeys it, including Crawl-delay, and waits at least 1.5 seconds between requests to one site. It doesn’t run JavaScript, log in, fill in forms or follow links beyond those pages. If a site answers with a bot check, a challenge page or “too many requests”, it stops at once and leaves the site alone for 90 days. It never uses proxies or other addresses to get round a block.
• What it keeps: the technologies it spotted, with their version, a confidence score and a short snippet of the evidence (for example a response header, a cookie’s name, a script’s address or a DNS record), the page address it came from, and when it was first and last seen. It doesn’t keep the pages themselves, and it doesn’t collect personal data on purpose; if a snippet ever contains some, tell us and we’ll remove it.
• Public pages: what the index knows about a site is shown at tellstack.onibaku.co.uk/site/<domain> and in lists of sites using each technology, to anyone.
• Opting out: add User-agent: TellstackBot and Disallow: / to your robots.txt and it won’t fetch any page of your site. It may still note what your public DNS records and certificate show. To have your site removed from the index and its public page, email admin@onibaku.co.uk with the domain: we delete its scans and history within 7 days. Keep the robots.txt rule in place too, or a customer’s lookup can scan the site again. More at tellstack.onibaku.co.uk/bot.

What it stores

On our server: your email address, your plan and credits used each month, your API keys (only a one-way hash and the first few characters, never the key itself), the domains in your bulk jobs and their results, your watches, and your webhook addresses and signing secrets with a record of each delivery. Like any web server, ours keeps access logs (IP address, time and the address requested, which for a lookup includes the domain), used only for security and fixing faults. In your browser: a sign-in cookie to keep you signed in, and a short-lived cookie that protects forms against cross-site requests.

Our licence server and payments

Pro is bought through our licence server (licence.onibaku.co.uk, run by us), which records your email address, the number of credit blocks you pay for and your licence key. Tellstack sends it your email address to check your plan. Payments are processed by Stripe, which collects your email address and card details; we never see your card. Sign-in links are sent through Resend.

So we can see where people get stuck, Tellstack also tells the licence server when you sign up, create your first API key and make your first lookup, and once on each day you use it; the licence server counts it when you open an upgrade link. It sends your email address, which the licence server turns into an anonymous ID with a one-way keyed hash and doesn’t store. Only a daily count of each is kept, against that ID, and deleted after 400 days. Nothing about the domains you look up is sent.

Page counts

Tellstack has no analytics or tracking scripts. If we add page counts, they’ll go to our own GoatCounter at stats.onibaku.co.uk, with no cookies and no IP addresses kept, and this section will say so first.

How your data is protected

The app and API are served only over HTTPS. API keys are stored as one-way hashes, and each can be limited to the scopes it needs. Sign-in uses single-use emailed links that expire after 15 minutes, so there are no passwords to leak. Webhooks are signed so you can check they came from us. The crawler only connects to public internet addresses. The database is backed up nightly, encrypted. Only Onibaku can reach the server.

How long data is kept, and how to delete it

Your account and everything in it is kept while you use Tellstack. Revoke keys and remove watches and webhooks from your dashboard, or through the API, and they’re deleted straight away. To delete your whole account, including your jobs, write to admin@onibaku.co.uk from its address: we remove everything within 7 days, and from backups within 30 days. Index entries are kept and refreshed while a site is public; a site’s owner can have its entry removed as described above. Purchase records are kept for six years for tax records.

Who we share data with

Only these processors, each for the job described above: Resend (email) and Stripe (payments). Webhooks go only to the addresses you add. We don’t sell data or share it with anyone else.

What it doesn’t do

• No headless browser, logins or form submissions on the sites it scans, and no getting round a site that blocks it.
• No list of which customer looked up which site, beyond the jobs and watches in your own account and the access logs above.
• No advertising or third-party trackers.
• No sale or sharing of data beyond the processors named above.

Keyrain (Android app)

Keyrain runs entirely on your device, with no Onibaku account or server. MIDI files you import, your best scores and your unlock are stored on your device only and excluded from Android backups; nothing is sent to us. The notes you play on a MIDI keyboard are checked against the song and not recorded. The unlock is bought through Google Play, which handles the payment; we receive only Google Play's anonymised sales reports. No ads, analytics, crash reporting or tracking SDKs. Full details: Keyrain privacy policy.

Standalone Wear Maps (Wear OS app)

This covers both editions: Wear Maps (free) and Wear Maps Pro.

Where it runs

The app runs on your watch. There's no Onibaku account and no Onibaku server: nothing you do in the app is ever sent to us.

What it uses, and why

• Your precise location, only while the app is open or while you're navigating, to show where you are on the map, follow you along the route and tell you when to turn. During navigation it's used by a foreground service, shown as an ongoing activity on your watch face, so guidance keeps working with the screen off. The app never uses your location in the background otherwise.
• What you search for. Typed searches, and spoken ones after your watch's own speech recogniser has turned them into text, are sent to Google to find matching places.

Who receives data

Maps, place search and directions come from Google Maps Platform, which processes the data on our behalf under the Google Maps Platform terms:

• When you search, Google receives your search text and your approximate position, so nearby places come first.
• When you ask for a route, or the app works out a new one because you've left the route, Google receives your current position, the destination and how you're travelling.
• The map itself is drawn by Google's Maps SDK, which downloads map images for the area on screen.

Everything is sent over HTTPS. We don't share data with anyone else, and no advertising, analytics or tracking SDKs are in the app.

What it stores

Your settings, your last six destinations and, in Pro, your Home and Work places are saved on your watch only. They're excluded from Android backups, so they never leave the watch. Remove a recent place by long-pressing it, or clear everything by clearing the app's storage or uninstalling it.

Payments

Wear Maps Pro is bought through Google Play, so Google handles the payment. We receive only the anonymised sales reports Google Play gives every developer.

What it doesn't do

• No account, sign-in or contact details.
• No location tracking or history: we never receive your location, and the app keeps none beyond the places listed above.
• No ads, analytics or sale of data.

Pluckbox (web app and API)

Where it runs

Pluckbox is a web app and API at pluckbox.onibaku.co.uk, run by us on our own server in the UK. Your account, your parsers, the documents and emails you send it, the fields it extracts, your API keys and your webhooks are stored there.

What it accesses, and why

• Your email address, to sign you in with an emailed link and to check your plan.
• The documents you send: files you upload in the dashboard or send to the API (PDFs, images, text and emails), and emails sent to a parser’s own address at in.pluckbox.onibaku.co.uk, including the sender’s address, the subject, the body and every attachment. We read them only to extract the fields your parser asks for.
• Your parsers: the fields you want, any notes for the AI, and the confidence below which a document goes to review.
• Documents are read with AI. We first read a document’s text on our own server: a PDF’s own text, or OCR (Tesseract) for scans and photos. That text, with your parser’s fields and notes, is sent to Anthropic (the Claude API) to fill in the fields. If a field comes back under your confidence bar, or the text couldn’t be read well, the page images are sent to Anthropic too. When you use “Propose fields”, the sample is sent to Anthropic to suggest the fields. Anthropic doesn’t use API data to train its models.
• Webhook addresses you add. We post each result to them: the extracted fields and their confidence scores, and the document’s name, type and page count and, for emails, the sender and subject. Each delivery is signed with a secret we keep for that purpose.

What it stores

On our server: your email address and plan; your parsers; for each document, the file itself (deleted after 7 days, see below), its name, type and page count, an email’s sender and subject, the extracted fields with their confidence scores and any corrections you make, its status, and which AI model read it, with the tokens used and their cost; how many pages you’ve used each month; your API keys (only a one-way hash and the first few characters, never the key itself), with their names, scopes and when they were last used; and your webhook addresses and signing secrets, with a copy of each delivery. In your browser: a sign-in cookie to keep you signed in, and a short-lived cookie that protects forms against cross-site requests.

Personal data in your documents

Invoices, receipts and emails often name people. For that data you’re the controller and we’re your processor: we handle it only to run Pluckbox for you, as this section describes, and the processors below are the only others who receive it. Only send documents you’re allowed to share with us.

Our licence server and payments

Pro is bought through our licence server (licence.onibaku.co.uk, run by us), which records your email address, the number of page blocks you pay for and your licence key. Pluckbox sends it your email address to check your plan. Payments are processed by Stripe, which collects your email address and card details; we never see your card. Sign-in links are sent through Resend, and emails to your parsers’ addresses are received by Resend and passed straight to us.

So we can see where people get stuck, Pluckbox also tells the licence server when you sign up, create your first API key and have your first document parsed, and once on each day you use it; the licence server counts it when you open an upgrade link. It sends your email address, which the licence server turns into an anonymous ID with a one-way keyed hash and doesn’t store. Only a daily count of each is kept, against that ID, and deleted after 400 days. Nothing about your documents or parsers is sent.

Page counts

Pluckbox has no analytics or tracking scripts. If we add page counts, they’ll go to our own GoatCounter at stats.onibaku.co.uk, with no cookies and no IP addresses kept, and this section will say so first.

How your data is protected

The app and API are served only over HTTPS. API keys are stored as one-way hashes, and each can be limited to the scopes it needs. Sign-in uses single-use emailed links that expire after 15 minutes, so there are no passwords to leak. Webhooks are signed so you can check they came from us, and are only sent to public internet addresses. The server is backed up nightly, encrypted, to our own storage and to Cloudflare R2. Only Onibaku can reach the server.

How long data is kept, and how to delete it

Uploaded files and emails are deleted from the server 7 days after they arrive. The fields extracted from them are kept until you delete the document (through the API) or its parser (in the dashboard or the API), which deletes them straight away. Revoke keys and remove webhooks from your dashboard or through the API and they’re deleted straight away, along with a webhook’s delivery records. To delete your whole account, write to admin@onibaku.co.uk from its address: we remove everything within 7 days. Our encrypted backups aren’t edited once made, so a backup can hold a copy of a file or record from before it was deleted; we only use backups to restore the service. Purchase records are kept for six years for tax records.

Who we share data with

Only these processors, each for the job described above: Anthropic (reading documents), Resend (email in and out), Stripe (payments) and Cloudflare (storing our encrypted backups, which it can’t read). Webhooks go only to the addresses you add. We don’t sell data or share it with anyone else.

What it doesn’t do

• No training of AI models on your documents, by us or by Anthropic.
• No reading of your documents by people, unless you ask us to help with one.
• No advertising or third-party trackers.
• No sale or sharing of data beyond the processors named above.

Support emails

If you email us, we use your email address and what you send only to help you, and delete support correspondence after 24 months.

This website

This site doesn't use cookies, analytics or tracking. Our web server keeps standard access logs (IP address, time, page requested) for up to 30 days for security.

Atlassian, Google and HubSpot

Your use of HubSpot is covered by HubSpot's privacy policy. Your use of Confluence, including the infrastructure the app runs on, is covered by Atlassian's privacy policy. Purchases and licensing through the Atlassian Marketplace are handled by Atlassian. Your use of Google Workspace is covered by Google's privacy policy.

Your rights

Under UK GDPR you can ask what personal data we hold about you, and ask us to correct or delete it. Email admin@onibaku.co.uk. You can also complain to the UK Information Commissioner's Office.

Changes

If we change how an app handles data, we'll update this page and the date above before the change takes effect.