openid and email identity scopes so multiple Google accounts connected to one Rhubarb account can be identified and managed separately.Rhubarb (the "Service") is provided by Rhubarb Analytics Inc. ("Rhubarb", "we", "us").
This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:
We may receive information from service providers (for example, payment confirmation from Stripe) or from advertising/analytics partners if you engage with our ads on other platforms (see Advertising and marketing).
If you choose to connect a Google Sheets data source, Rhubarb uses Google API Services to request read-only access to Google Sheets. We may collect and process information returned by Google APIs only as needed to provide the connected data source feature, including spreadsheet identifiers, sheet/range configuration, row and column values returned from the sheet, OAuth tokens, token metadata, scopes, refresh status, and error messages needed to operate and troubleshoot the integration.
We do not receive or store your Google password. Google authentication occurs with Google. For spreadsheet data, the connector requests https://www.googleapis.com/auth/spreadsheets.readonly, not spreadsheet write access or broad Google Drive access. This OAuth permission can allow Rhubarb to read spreadsheets accessible to your Google account; it cannot be restricted to the single spreadsheet, tab, or cell range entered in Rhubarb. Our connector uses your saved sheet and range configuration to select the data it requests. Transforming an imported copy in Rhubarb does not write changes back to Google Sheets. Rhubarb also requests openid and email solely to receive Google's stable account identifier and verified primary email address. The stable identifier is used to distinguish connected Google accounts; the email address is used as a display label and is not the identity key.
We use personal information for the following purposes:
Rhubarb's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
For Google Sheets integrations, we use Google user data to provide the user-facing features you request, such as importing spreadsheet values, refreshing and previewing your data source, and producing visualizations or dashboards. We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or for lending purposes. We also follow the Google Workspace API user data and developer policy.
Google data and AI model training: Notwithstanding any other provision of this Policy, Rhubarb does not use, retain, or transfer information obtained through Google APIs, including derived, aggregated, or anonymized data, to create, train, or improve generalized, non-personalized, or cross-user AI or machine-learning models. We do not authorize our providers to do so, including through model-improvement programs, shared training datasets, or provider feedback submissions. Notice or consent described elsewhere in this Policy does not create an exception to this restriction.
When you request an AI-assisted feature and authorize the applicable data sharing through the Service, relevant Google-derived content may be sent to the disclosed AI provider, including OpenAI or Anthropic, to generate that requested answer, code, analysis, or visualization. Running a model for your request is distinct from training a model. Connecting Google Sheets by itself does not authorize unrelated AI processing or publication. We require providers that receive Google data to observe the applicable Google data-use restrictions, and do not send Google OAuth credentials as AI context.
Transfers and human access to Google API data are limited by Google's policies. Human access requires your affirmative agreement to view specified data, a security purpose such as investigating abuse, a legal obligation, or another narrowly permitted exception, such as properly aggregated and anonymized internal operations. General references elsewhere in this Policy to support, analytics, feedback, service improvement, provider practices, or business transfers do not expand these permissions. Provider storage, security screening, and retention must remain consistent with the permitted purposes; we do not promise that API inference involves zero retention or no possible authorized human access.
See Google Sheets connection choices below for the distinction between disconnecting one source, revoking one identified Google account, and deleting imported data.
When you use an AI-assisted feature, Rhubarb may send information relevant to your request to OpenAI, Anthropic, or another commercial AI provider. The provider used may depend on the model you select, feature availability, performance, safety requirements, pricing, or operational needs.
Depending on the feature and context, information sent to an AI provider may include:
The information transmitted depends on the feature you use and the context needed to produce the requested result. If you ask an AI-assisted feature to work with an uploaded or connected data source, relevant content from that source may be included in the provider request. You should not place passwords, private keys, access tokens, payment-card information, highly sensitive personal information, regulated data, or other secrets in prompts or AI-visible content unless Rhubarb has expressly agreed in writing that the applicable feature may be used for that information.
Rhubarb currently uses commercial or API offerings from OpenAI and Anthropic. Under their standard commercial or API data practices, provider inputs and outputs are not used to train generalized provider models by default unless the customer affirmatively opts in, submits provider feedback, or otherwise agrees to such use. For non-Google content, Rhubarb does not knowingly opt content submitted through its AI-assisted features into a third-party provider's generalized model-training program unless we first provide any notice and obtain any consent required by applicable law. Google API data and derived data are excluded from any such opt-in; Section 4.1 controls regardless of any broader consent or provider program.
AI providers may temporarily retain request content, response content, and metadata; perform automated safety, security, or abuse screening; and, in limited circumstances, permit authorized personnel to review content for service delivery, support, incident response, legal compliance, or enforcement of provider policies. Some provider features may store application state or files for longer periods. Retention and review practices depend on the provider, feature, model, configuration, contractual terms, and legal or safety requirements. For current provider explanations, see OpenAI's API data controls documentation and Anthropic's commercial data handling and retention information.
When Rhubarb submits a request through Rhubarb's provider account, Rhubarb is the provider's customer. Your use of that Rhubarb feature does not, by itself, create a separate provider account or direct contract between you and the provider. If you connect your own provider account, provide your own API key, or use the provider separately, that separate use may be governed directly by the provider's terms and privacy notices.
We do not sell content submitted to AI-assisted features, and we do not use that content for targeted advertising. We may add, replace, restrict, or discontinue AI providers or models and will update this Policy or provide additional notice where required by law.
If you are in the EEA or UK, we rely on one or more of the following legal bases (depending on the context):
We use cookies and similar technologies for:
If enabled, Google Analytics uses cookies or similar technologies to collect and analyze information about use of the Service. This information is generally transmitted to and processed by Google. We use Google Analytics reports to understand how people use the Service and to improve it.
Your choices: Where required by law, we will ask for your consent before setting analytics cookies. You can also manage your cookie preferences through our cookie banner/controls (when available), and you may be able to limit Google Analytics by using browser settings or tools provided by Google.
Depending on your location, you may have choices about certain cookie categories. If we implement a cookie consent banner, it will provide these choices where required and allow you to change your preferences later.
We may share personal information with:
We do not disclose your connected data source credentials to other users. We use them only to provide the Service (for example, to access a connected source at your direction).
AI providers process information on Rhubarb's behalf under Rhubarb's provider account or commercial arrangements when Rhubarb submits your request. Provider terms, subprocessors, models, processing locations, retention practices, and availability may change. Rhubarb may take steps such as filtering requests, restricting a model, or suspending a feature when reasonably necessary to comply with law or provider requirements.
We do not sell Google user data or use Google user data for advertising. We do not transfer Google user data except as necessary to provide or improve the user-facing features you request, comply with law, protect rights and security, or as otherwise permitted by the Google API Services User Data Policy.
We may send marketing emails. You can opt out at any time by using the unsubscribe link (when provided) or by contacting us at [email protected].
We may use targeted advertising to reach potential Rhubarb users on other platforms. Depending on how advertising technology is configured, some jurisdictions may treat certain ad-related disclosures as "sharing" for cross-context behavioral advertising.
California notice: If "sale" or "sharing" is interpreted to include certain advertising technology activities, we will comply with applicable law and honor opt-out requests where required.
Opt-out (where applicable): You can request to opt out of sale/sharing and targeted advertising by emailing [email protected] with the subject line "Opt out of sale/sharing".
We retain information for as long as necessary to provide the Service and for legitimate business purposes such as security, compliance, and dispute resolution.
Where a specific retention period is not listed, we use criteria such as account status, operational necessity, and legal requirements to determine retention.
We use reasonable administrative, technical, and organizational measures designed to protect personal information. Connected data source credentials, including Google OAuth credentials, are intended to be encrypted at rest and used only by authorized Rhubarb application processes to provide the connected data source feature. Content submitted to AI-assisted features is transmitted to the applicable AI provider and is therefore also subject to that provider's security controls and Rhubarb's contractual arrangements with the provider. No method of transmission, processing, or storage is 100% secure. You are responsible for keeping your account credentials confidential and for avoiding the submission of unnecessary secrets or highly sensitive information.
Rhubarb primarily stores Service data in the United States. Rhubarb and its service providers, including cloud, analytics, support, and AI providers, may process personal information in the United States and other countries where they or their subprocessors operate. For example, an AI provider may route requests through infrastructure in more than one country even when stored provider data is maintained in the United States.
If you are located in the EEA, UK, Switzerland, or another jurisdiction that restricts international transfers, we will use an appropriate transfer mechanism where required, such as standard contractual clauses, an applicable UK transfer addendum or agreement, adequacy decisions, or another lawful mechanism, and implement supplementary measures as appropriate.
You may request access to, correction of, or deletion of your personal information by contacting [email protected]. We will respond as required by applicable law.
If you are a California resident, you may have rights to know, delete, correct, and to opt out of the sale or sharing of personal information (as those terms are defined under California law). You may also have the right to limit the use and disclosure of sensitive personal information in certain circumstances.
To submit a request, email [email protected] with "California Privacy Request" in the subject line. Please include enough information for us to verify your request.
If you are located in the EEA or UK, you may have rights including access, correction, deletion, restriction, portability, and the right to object to certain processing. You may also withdraw consent where we rely on consent.
To exercise these rights, email [email protected] with "GDPR Request" in the subject line. We will respond within the timeframe required by applicable law.
Disconnect this data source: In the data source editor, choose Disconnect this data source. Rhubarb stops its scheduled and queued imports, removes that source's saved OAuth credentials, and prevents automatic public-access fallback. Ordinary saves, AI Apply, and version restores do not reconnect it. An upstream request already sent cannot be recalled, but its result is discarded if the source was disconnected before the result was saved. Previously imported data remains available under its existing visibility and AI-sharing settings; disconnection is not deletion or unpublishing.
Reconnect or resume: Connect Google explicitly to reauthorize private access. To resume without Google authorization, first save Public or Auto access mode, then select Resume public access for the saved sheet settings. Either action can queue a new import; a previously disabled automatic schedule is not silently restored.
Manage Google connections: The Rhubarb account owner can open Account → Manage Google connections to see each Google account that Rhubarb has identified for that Rhubarb account. Rhubarb uses Google's stable OpenID Connect account identifier to keep those Google accounts separate and displays the verified primary email as a label. The owner can request revocation for one listed Google account at a time. Rhubarb stops the Google Sheets sources in that Rhubarb account that are associated with the selected Google identity and leaves sources associated with other identified Google accounts alone. Google's revocation is grant-wide for that Google account and Google Cloud project, however, so it can invalidate other OAuth tokens for the same Google account and project, including a connection in another Rhubarb account or another OAuth client in that project. This action retains imported data and does not change Google's sharing settings for the original sheet.
Google revocation may be pending while Rhubarb retries. Sources associated with that identified Google account stay stopped while revocation is pending. Connections created before Rhubarb began storing Google's stable account identifier cannot be safely grouped by Google account from their spreadsheet URLs or refresh tokens; the Service may ask you to reconnect those sources once so Google can identify the account. Permissions whose usable credentials were already deleted or cannot be decrypted may need to be removed directly from Google Account connections. Revoking OAuth access alone does not make a publicly shared sheet private or stop a separately configured public import; disconnect those sources in Rhubarb too.
Delete imported data: Use the data source editor's existing Delete action to remove that Rhubarb source and its stored source data. Separately remove any derived visualizations, copies, exports, or conversations you no longer want retained. This does not delete or edit the original Google spreadsheet. Contact [email protected] to request related-data deletion, subject to applicable retention requirements.
The Service is not intended for children under 13. If you believe a child under 13 has provided us personal information, please contact us at [email protected] and we will take appropriate steps.
We may update this Privacy Policy from time to time. We will update the "Last updated" date above, and we may provide additional notice where required by law.
If you have questions about this Privacy Policy or our privacy practices, contact: