App Garden

Small, sharp spreadsheet add-ins

Privacy notice

Every App Garden add-in. Last updated 6 October 2026.

The short version

Your workbook never leaves your machine. The add-ins have no accounts and collect no analytics. Each add-in makes exactly one kind of network request — checking a licence key, which carries a key and an anonymous install id and no workbook content of any kind. These pages are served through Cloudflare, whose bot protection may run a script of its own. They also count visits with Cloudflare Web Analytics, and the prices pages load Paddle's checkout script, which brings analytics of Paddle's with it. Both are described below, and neither ever sees anything from your workbook.

What this covers

One notice for the ten App Garden add-ins for Excel™, because they all handle data the same way: the workbook is read into the task pane, analysed there, and never transmitted. Where they differ, the clause says which is which. It is the task pane and not your hard disk that matters here — the add-in behaves the same whether you are running Excel™ on your desktop or Excel™ on the web.

The AI Readiness Scanner and Fixer is not covered by this notice, and it has its own. It is a Google Sheets™ add-on rather than an Excel™ add-in, and that is a real difference rather than a label. Its rules run in the browser, as these run in the task pane — but it reads and writes the spreadsheet through an Apps Script™ half running on Google’s servers, and it keeps its licence record in Apps Script™ user properties rather than on your machine. Nothing in the spreadsheet is sent to App Garden either way; the paragraph above is simply not the right description of it, and a privacy notice that is nearly true is worse than two that are.

And, under its own notice rather than this one: AI Readiness Scanner and Fixer for Google Sheets™ — support, prices, privacy notice.

What the add-ins read

Hardcoded Value Detector reads the used range of the worksheet being checked: cell values, value types, number formats and formulas. The whole-workbook scan does the same for each visible sheet; hidden sheets are skipped.

AI Readiness Scanner and Fixer reads the used range of the active worksheet: cell values, value types, number formats, merged areas, table definitions, hidden rows and columns, sheet and table names, and the workbook's calculation mode.

Two-File Reconciliation reads the two sources you pick from the lists — a worksheet's used range or a table in the open workbook: cell values, value types, number formats, cell addresses, and the sheet and table names the lists are built from. Formulas are not read; reconciliation compares values. If you reconcile against a CSV instead, that file is read in the task pane by the browser and parsed there — it is not uploaded.

Change Diff reads the used range of each sheet in the open workbook: cell values, value types, number formats and formulas, along with the workbook's defined names and their scope. The earlier version is a saved .xlsx you hand over through a file picker; Excel™'s own API cannot open a second workbook, so that file is parsed inside the task pane and, like everything else here, is never uploaded. A workbook's VBA project is deliberately not read.

Import Cleaner for Xero reads the used range of the worksheet being cleaned or checked: cell values, value types, number formats and formulas, cell addresses, and the worksheet and table names.

Structure Flattener reads the used range of the report being flattened: cell values, value types, number formats, formulas, cell addresses, and whether a cell is bold — the bold run is part of how a header row is told from a data row. Sheet names and visibility are read to build the list of sheets you can flatten; only visible sheets are offered.

Unit-aware Calculation Checker reads the used range of the sheet being checked: cell values, value types, number formats, formulas, cell addresses, and the column headers, row labels, units rows and cell notes the units are written in. The whole-workbook check does the same for each visible sheet. Unit overrides you set are stored in the workbook so they travel with it; nothing about them leaves the file.

External Link and Dependency Mapper reads the whole workbook rather than one sheet, because a link can be anywhere in it: formulas and their precedents, defined names and their scope, data-validation lists, conditional-format rules, hyperlinks, and the cell addresses and sheet names all of those sit on. It reads the paths those references point at — a file name, a folder, a SharePoint™ or OneDrive™ address — because the path is the finding. Nothing is followed: the add-in never opens, fetches or contacts anything it finds a link to, and cannot tell you whether the file at the other end still exists.

Selection-Scoped Formula Explainer reads the formula in the cell you selected and then follows it: the cells, ranges, defined names and table columns it refers to, wherever in the workbook they are, along with their current values, value types, number formats and addresses, and the header rows and row labels around them — the labels are what turn Sheet2!$C$2:$C$500 into “the Unit price column on Price list”. It reads the other formulas on the sheet to count how often a typed-in value appears, and the whole-sheet explanation on the paid tier reads every formula on that one sheet. A reference into a workbook that is not open is not followed: the add-in never opens or fetches another file, so it reports Excel™'s last cached value and says that is what it is.

In every case all of it is read into memory in the task pane, analysed there, and discarded when the pane closes. None of it is transmitted anywhere. For nine of the ten the licence check is the only request the add-in makes, and it carries a licence key and an install id — never a cell, a formula, a sheet name, a file name, a score or a finding.

Calculation Sign-Off and Lock makes one further request, and only when you ask it to. Countersigning a sign-off sends the fingerprints themselves to the licence server. A fingerprint is a one-way hash: it cannot be turned back into the formulas or the values it was computed from, and it is not reversible by us or by anyone else. No formula, no cell value, no sheet name and no file name is transmitted with it. Verifying a signed workbook makes no request at all — it is done entirely inside Excel™, which is why it works with no licence, no account and no network.

What they write

Calculation Sign-Off and Lock writes when you sign: a sign-off record stored inside the workbook itself, sheet protection on the sheets it signed, and — if you ask for it — a printable Sign-off sheet. The record travels with the file, so anyone you send it to can check it. Removing the protection again is free in every tier and is named Remove protection. Nothing it writes leaves your machine.

For the rest: nothing, until you apply a fix. Scanning and checking never modify your workbook. A fix changes only the cells described in the finding you acted on, and takes a restore point first so the change can be reversed. Restore points are held in the workbook's own settings, inside the workbook file, on your machine.

Breaking a link in the External Link and Dependency Mapper replaces the reference with the value it last returned, in the cells you chose and nowhere else, and takes a restore point first. Both the preview and the reversal happen in the workbook on your machine.

The Selection-Scoped Formula Explainer does not write to your workbook at all, and has no fix to apply. Its one exception is off by default and asks first: showing the live value of each step means writing those steps to a hidden worksheet and deleting it again within the same operation, which clears Excel™'s redo history. Nothing you authored is touched either way, and every other part of the pane works without it.

The Hardcoded Value Detector's exported report is a file your browser saves locally. It quotes your own formulas and cell addresses, so treat it as workbook content — it is never uploaded, and there is nowhere for it to be uploaded to.

What is stored on your device

One entry in browser local storage per add-in, holding your licence entitlement and a randomly generated install identifier. The identifier is a random value; it is not derived from you, your machine, or your Microsoft account. It goes to the licence server with your key, so that a licence can be counted against installs rather than against people, and nowhere else.

Clearing your browser storage, or Office's cache, deletes it — the entry is a cache, so losing it costs you nothing beyond re-pasting your key, and re-entering the same key does not cost you a seat.

The licence server

Activating a key, and the periodic check that confirms it still works, send three things to a Cloudflare Worker run by App Garden: your licence key, the install identifier above, and an instance id the server issued for this install. That is the entire request. It carries no workbook content, no file name, no score and no findings, and there is nothing in it that identifies you beyond the key you bought.

The server stores, against your key, which subscription it came from, how many seats it covers, whether that subscription is live, and the installs currently holding a seat. It keeps no name, no email address and no payment details — those stay with Paddle.

When a key is first issued, the server also emails it to you, so there is a copy to find again if Excel™ forgets it. To do that it asks Paddle for the email address on your purchase at the moment of sending and passes it, with the key and the add-in's name, to Resend (privacy policy), which delivers the message from servers in the EU (Ireland). The address is not stored by the licence server. Resend keeps a record of the messages it sends under its own policy.

A free installation never contacts it at all, because there is no key to check.

Payment

Paddle is the merchant of record for purchases and runs the checkout. If you buy, Paddle collects and holds your payment and billing details under its own privacy policy; App Garden never sees a card number, and the licence server stores no name or email address. Paddle's checkout runs on the prices pages only — it is not loaded by the add-ins, and not by this page.

Paddle's checkout script loads a second one of its own, ProfitWell (public.profitwell.com), which is Paddle's subscription analytics. It is loaded by Paddle, not by App Garden; it runs on the prices pages only, for the same reason the rest of the checkout does; and it is covered by Paddle's privacy policy rather than by anything App Garden controls. App Garden receives nothing from it. If you would rather not load it, blocking public.profitwell.com does not stop the rest of the page working — only the checkout needs Paddle's script.

What passes back to App Garden from Paddle is the subscription: which plan, how many seats, and whether it is still active. That is what your key is minted from. The one other thing the licence server reads from Paddle is the email address the key is sent to, described above.

Third parties

No error-reporting service and no advertising, anywhere. App Garden uses Cloudflare Web Analytics to count visits to the pages on appgarden.co.uk. It sets no cookies and does not follow you from one site to another. It records which page was loaded, which site you came from, and your rough country, browser and device type. Nothing from your workbook or spreadsheet is involved. Blocking static.cloudflareinsights.com stops it, and nothing on the site stops working. The other analytics script on this site is ProfitWell, described under Payment above, which Paddle's checkout loads on the prices pages and which App Garden gets nothing from. The add-ins' files are served from appgarden.co.uk, which is hosted on Cloudflare. Cloudflare records ordinary web access logs — IP address, time, file requested — as any web server does, and applies its standard bot protection, which adds a small script of its own to each page it serves. That script is Cloudflare's, not ours; it looks at how the page was requested in order to tell automated traffic from people.

It cannot see your workbook. Nothing running in the pane has access to Excel™ except the add-in itself, and the add-in still sends nothing anywhere. What Cloudflare learns is that somebody loaded a page, which is what any website's host knows.

Microsoft delivers the add-ins and hosts Office itself, and its own privacy terms apply to that. Nothing here changes them.

Email to [email protected] is received and stored by Apple's iCloud Mail, and licence-key emails are sent by Resend, as described under The licence server above.

Your rights and contact

On the free tier no personal data is collected or held at all, and there is nothing to export or erase beyond the local storage entry you can clear yourself. If you hold a licence, the key and its install ids can be erased on request — that ends the licence, so say so explicitly. Payment records are Paddle's and are requested from Paddle. To ask about any of this, email [email protected].