What data reaches Applane?

Your employees’ browsers talk to Google with tokens minted by your OAuth client in your GCP project. The apps run on your Apps Script. The model runs on your Vertex AI billing. The audit trail is your Cloud Audit Logs. Applane’s backend stores your configuration, the email addresses of the people who build, and your invoice.

What reaches Applane

From	What	Why	Kept?
The extension, before sign-in	Your domain name	To find your company’s record and return its OAuth client id	No
The extension, at sign-in	A Google ID token: your email, your domain, a nonce	To prove who is signing in before issuing a licence. Checked, then discarded.	The email becomes a seat row. The token is not stored.
The extension, daily	The same, to renew the licence	Same	Same
The admin console	What admins type: company name, project id, client id, group and bot addresses, settings, seat actions	To run the company	Yes, as the tenant record and the audit log
The setup checker	Pass or fail per check	To show the checklist	Yes, pass/fail only
Checkout	Nothing; the card goes to the payment provider	Billing	The provider holds it

Back from Applane to the extension: the tenant configuration and a signed licence.

What never reaches Applane

• Google access tokens or refresh tokens. The extension holds them in Chrome’s identity plumbing and sends them to Google only.
• App source, files or versions. They live in Apps Script projects in your Drive.
• Prompts, chat history or agent transcripts. They live in the builder’s browser; the model call goes from the browser to Vertex AI in your project.
• Sheet, Doc, Drive, BigQuery or Firestore contents.
• Who opens or uses a deployed app. Viewers are never counted or seen.
• A copy of your app inventory.

The contract types the extension is built against have no field for any of these, so they cannot be sent by accident.

Where each call goes

Call	From	To	With
Sign in	Extension	accounts.google.com, your client	The employee’s Google session
Build (model call)	Extension	Vertex AI in your project	The employee’s token, cloud-platform scope
Create, push, deploy an app	Extension	Apps Script API	The employee’s token, script.* scopes
Read sheets, docs, Drive	Extension	Sheets, Docs, Drive APIs	The employee’s token
Run an app	The viewer’s browser	script.google.com	The viewer’s own Google session
Find the company, get a licence	Extension	Applane API	Domain, then ID token
Admin console	Admin’s browser	Applane	Applane’s own sign-in (openid email profile)

The setup checker’s test sign-in runs from the admin’s browser against Google; the token it gets stays there.

Hosting

Applane’s backend runs on Supabase in Frankfurt (AWS eu-central-1), behind Cloudflare with EU data localisation on. Payments are on Stripe. Transactional email goes through an EU provider. No US transfer for the data Applane processes on your behalf. See DPA and sub-processors.