Privacy notice

Copilot Readiness Scanner. Last updated 31 August 2026.

The short version

Your workbook never leaves your machine. The add-in has no accounts and collects no analytics. It makes exactly one kind of network request — checking a licence key, which carries a key and an anonymous install id and no workbook content of any kind. The pages are served through Cloudflare, whose bot protection may set a cookie and runs a script of its own; that is described below, and it never sees anything from your workbook.

What the add-in reads

To score a sheet it reads the used range of the active worksheet: cell values, value types, number formats, merged areas, table definitions, hidden rows and columns, sheet and table names, and the workbook's calculation mode. All of it is read into memory in the task pane, analysed there, and discarded when the pane closes.

None of it is transmitted anywhere. The licence check is the only request the add-in makes, and it carries a licence key and an install id — never a cell, a formula, a sheet name or a score.

What it writes

The scanner does not modify your workbook. The fixes, where you apply them, change only the cells described in the finding you acted on, and take a restore point first so the change can be reversed.

What is stored on your device

One entry in browser local storage, holding your licence entitlement and a randomly generated install identifier. The identifier is a random value; it is not derived from you, your machine, or your Microsoft account. It goes to the licence server with your key, so that a licence can be counted against installs rather than against people, and nowhere else. Clearing your browser storage, or Office's cache, deletes it — the entry is a cache, so losing it costs you nothing beyond re-pasting your key.

Restore points for applied fixes are held in the workbook's own settings, inside the workbook file, on your machine.

Third parties

No analytics provider, no error-reporting service, no advertising. The add-in's files are served from appgarden.co.uk, which is hosted on Cloudflare. Cloudflare records ordinary web access logs — IP address, time, file requested — as any web server does, and applies its standard bot protection, which adds a small script of its own to each page it serves. That script is Cloudflare's, not ours; it looks at how the page was requested in order to tell automated traffic from people.

It cannot see your workbook. Nothing running in the pane has access to Excel except the add-in itself, and the add-in still sends nothing anywhere. What Cloudflare learns is that somebody loaded a page, which is what any website's host knows.

Paddle is the merchant of record for purchases and runs the checkout. If you buy, Paddle collects and holds your payment and billing details under its own privacy policy; App Garden never sees a card number, and the licence server holds no name or email address. Paddle's checkout runs on the prices page only — it is not loaded by the add-in, and not by this page.

Microsoft delivers the add-in and hosts Office itself, and its own privacy terms apply to that. Nothing here changes them.

The licence server

Activating a key, and the periodic check that confirms it still works, send three things to a Cloudflare Worker run by App Garden: your licence key, the install identifier above, and an instance id the server issued for this install. That is the entire request. It carries no workbook content, no file name, no score and no findings, and there is nothing in it that identifies you beyond the key you bought.

The server stores, against your key, which subscription it came from, how many seats it covers, whether that subscription is live, and the installs currently holding a seat. It keeps no name, no email address and no payment details — those stay with Paddle.

A free installation never contacts it at all, because there is no key to check.

Your rights and contact

On the free tier no personal data is collected or held at all, and there is nothing to export or erase beyond the local storage entry you can clear yourself. If you hold a licence, the key and its install ids can be erased on request — that ends the licence, so say so explicitly. Payment records are Paddle's and are requested from Paddle. To ask about any of this, email [email protected].