Security

Last updated: 2026-11-09

Where it runs

Two-Way Sync for Airtable runs on our hosting providers, listed below. Its data is stored by Cloudflare, Inc. in a Cloudflare D1 database that we place in North America (Cloudflare treats the location as a preference, not a guarantee). Requests are handled on Cloudflare's global network, at the data centre nearest to you, under Cloudflare's data processing addendum.

Hosting and processing for us:

• Cloudflare, Inc.: hosting and database (Workers and D1) (United States and its global network).

Payments: Polar Software, Inc., our reseller, receives only the checkout details our privacy policy lists (your email address and your customer id); it does not host the product's data.

What is stored, and for how long

• Your Google account id, email address and Workspace domain. Kept: Until you delete your data, or within 30 days after you stop using the add-on.
• The settings you save in the add-on. Kept: Until you change them or delete your data, or within 30 days after you stop using the add-on.
• Your subscription status (plan, state and period end), as read from our reseller. Kept: Up to 7 days, then read again; deleted with your other data.
• Your Airtable personal access token and, if you turn on hourly sync, a Google offline access token for your spreadsheets, both encrypted. Kept: Until you replace or remove them, stop hourly sync or delete your data, or within 30 days after you stop using the add-on.
• Each sync you set up: the spreadsheet and tab, the Airtable base, table, view and table name, the fields, the conflict rule, the hourly setting and the last run's counts or error. Kept: Until you remove the sync or delete your data, or within 30 days after you stop using the add-on.
• For each synced record, its Airtable record id and a short hash of each field's value at the last sync (not the values themselves). Kept: Until the next sync replaces them, you remove the sync or delete your data, or within 30 days after you stop using the add-on.
• While a sync runs, the records and cells of the Airtable table and the tab you sync, which may include personal data about other people. Kept: Not stored: held in memory only while the sync runs.

Everything is deleted within 30 days of uninstall, or when you ask, unless the law requires us to keep a record (for example, invoices).

Encryption

Data travels encrypted over HTTPS. Stored data is encrypted at rest, as provided by our hosting providers. Access tokens and keys the product stores are encrypted.

Access

Access to the systems and the stored data is limited to Sweekly Apps LLC, the developer, and used only to run, support and secure the product. The service providers above process data only as our privacy policy describes.

No selling, no AI training

We do not sell customer data, use it for advertising, or use it to train AI models.

Reporting a vulnerability

If you find a security vulnerability in the product, email support@sweekly.app with the details. We look into every report.

Incidents

If a security incident affects your data, we notify affected customers without undue delay, with what we know and what we are doing about it, and we notify Polar where its terms require it.