What data reaches Applane?

Use this page to review the boundary between your Google environment and Applane. App data, source and prompts do not pass through Applane’s backend. Account configuration, licence checks, billing and service records do.

What reaches Applane

From	What	Why	Kept?
The builder, before sign-in	Your domain name	To find your company’s record and return its OAuth client id	No
The builder, at sign-in	A Google ID token: your email, your domain, a nonce	To prove who is signing in before issuing a licence. Checked, then discarded.	The email becomes a seat row. The token is not stored.
Licence renewal	Sign-in identity and licence request	Renew building access	Account activity is retained; the Google ID token is discarded.
Hosting requests	Request path, status, IP address and browser information	Serve the builder and diagnose service failures	Request logs are kept for 30 days.
The admin console	What admins type: company name, project id, client id, group and bot addresses, settings, seat actions	To run the company	Yes, as the tenant record and the audit log
The setup checker	Pass or fail per check	To show the checklist	Yes, pass/fail only
Checkout	Nothing; the card goes to the payment provider	Billing	The provider holds it

Back from Applane to the builder: the tenant configuration and a signed licence.

What never reaches Applane

• Google access tokens or refresh tokens. The builder holds the access token in memory for the life of the tab and sends it to Google only. There is no refresh token: the flow is implicit, with no client secret.
• App source, files or versions. They live in Apps Script projects in your Drive.
• Prompts, chat history or agent transcripts. They live in the builder’s browser; the model call goes from the browser to Vertex AI in your project.
• Sheet, Doc, Drive, BigQuery or Firestore contents.
• Who opens or uses a deployed app. Viewers are never counted or seen.
• A copy of your app inventory.

The licence API has no fields for app content. Google access tokens remain in browser memory and are sent only to Google.

Where each call goes

Call	From	To	With
Sign in	The builder	accounts.google.com, your client	The employee’s Google session
Build (model call)	The builder	Vertex AI in your project	The employee’s token, cloud-platform scope
Create, push, deploy an app	The builder	Apps Script API	The employee’s token, script.* scopes
Read sheets, docs, Drive	The builder	Sheets, Docs, Drive APIs	The employee’s token
Run an app	The viewer’s browser	script.google.com	The viewer’s own Google session
Find the company, get a licence	The builder	Applane API	Domain, then ID token
Admin console	Admin’s browser	Applane	Applane’s own sign-in (openid email profile)

The setup checker’s test sign-in runs from the admin’s browser against Google; the token it gets stays there.

Hosting

Applane’s account backend runs on Supabase in Ireland (eu-west-1). Cloudflare serves the sites and licensed builder files; Stripe handles payments. Website analytics and contact-form processing are separate from app data. See DPA and sub-processors.