Privacy
Effective: 2026-11-02
TablePop is run by Bosau Digital LLC (trading as Python & VBA), 1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, United States. We decide what happens to the data on this page, which makes us its controller. This page explains what the service stores, who else touches it, and how to get rid of it. It is written to be read, not to be survived.
The one thing to understand first: a published TablePop page is on the open web. A new page is unlisted: search engines are asked not to index it, but anyone who has or guesses its address can open it. A page you make public can be indexed. On Pro you can protect a page with a password, and then only readers who enter it see the table. Unless a page has a password, do not publish a table you would not put on a public website.
1. What we collect
What the service stores about you:
| Your account | Your email address and your password. We store the password only as an argon2id hash, never the password itself, so we cannot see it. To create an account or reset a forgotten password, you type back a six-digit code we email to that address. You can add a display name on the Account page if you want to; it is optional. If you use Continue with Google, we store your Google account's ID, its email address and your name as Google gives them; the name becomes your display name. When you create an account, we note what sent you to TablePop (a website's domain such as google.com, or a short campaign label from a link) and whether you signed up in the dashboard or in the Excel add-in, to learn how people find us. |
|---|---|
| Sessions | When you sign in, we create a session: a cookie in the dashboard, or a token kept by the Excel add-in. We store only a hash of the token, never the token itself, so a copy of our database cannot be used to impersonate you. With it we keep a coarse device label, such as "Excel add-in" or "Dashboard · Chrome on Windows", and roughly when it was last used, so you can see your sessions on the Account page and sign any of them out. |
| Your plan | Your plan and, if you bought one, your license key. When you sign up, sign in and from time to time while you use TablePop, we send your email address to our own license service on pythonandvba.com to find TablePop plans bought with it, so a purchase attaches itself, and we check your key there. If you cancel in the dashboard, the reason you give goes to that service with the request. |
| Your published tables | The rows, columns and settings of every page you publish, plus its title, description, theme, address and who can see it (unlisted, public or password). When you update a page's data, we keep the last 10 earlier versions so you can bring one back. If you protect a page with a password, we store only a hash of that password. Logos you upload are stored with your account, and a custom domain you connect is registered with Cloudflare so it can serve the page. We store all of this so we can serve your pages. |
| View counts | A number per page and per day, split into page views and embed views. It says nothing about who the readers are (see section 2). |
| Account activity | A record of the actions in your account (sign-ins, pages published, updated or deleted, plan changes) and of which days the account was used and from which client, the dashboard or the Excel add-in (with its version). We keep it to run and improve the service. It holds no IP addresses and no page contents, is kept for up to two years and is unlinked from you when you delete your account, and is never shared with third parties. |
| Support and admin records | When we help you, we may keep a short note on your account, such as "refund promised"; notes are deleted with the account. Every admin action on an account, such as a suspension, is logged with the account's email address, and that log is kept so we can show later what was done and why. We also send ourselves internal summary emails (a weekly overview, and a note when an account starts paying) that can include account email addresses and page titles. |
TablePop does not require your name, and does not ask for your company, your address or your phone number. If you buy a paid plan, the checkout on pythonandvba.com asks for what an invoice needs, and we never see your card details (see section 3). We do not read the rest of your workbook · the add-in sends only the range you selected, when you press Publish or Update, or by itself when that range changes while Auto-update is on.
If you report a page
The report form stores the page address you give and the page it matched, the category, your explanation, your relation to the matter and, only if you give them, your name and email address, plus what we decided and when. It stores no IP address and nothing about your browser; to stop floods, it counts reports per network for a short while, in memory only. When a report arrives we email ourselves its number, category and the page address; your explanation and contact details stay in our database. We do not show your report or your details to the page owner unless the law requires it. A report in our database is kept while it is open and deleted two years after it is resolved. A report you email to us instead stays in our abuse mailbox.
Visits to tablepop.app itself
TablePop's own pages on tablepop.app (the home page, this page, the terms and the report page) count their visits with a small analytics system that we run ourselves. It is not a third-party service, and it sets no cookie. It never runs on published tables, on custom domains or in the dashboard: the readers of your pages are not counted by it.
When you open one of these pages, your browser sends a short message to our own server, api.pythonandvba.com. It records:
- the address of the page, without anything after a question mark, except campaign labels (utm_ parameters, or our own ref label) if the link you followed carried them, and how long the page was open and visible;
- the website that referred you, without anything after a question mark; when you come from a published TablePop page or through its "Made with TablePop" link, on whatever address it is published, that page's address is left out;
- your country, worked out from your IP address with a database on our own server;
- your browser, operating system and device type (computer, phone or tablet), from the identification your browser sends with every request;
- clicks on the add-in, plan, checkout, download and outside links, as the link's address without anything after a question mark.
To count a visitor only once a day, our server calculates an anonymous identifier (a SHA-256 checksum) from your IP address, your browser's identification, the site's name and a random value that it creates fresh every day and deletes within two days. Once that value is gone, the identifier cannot be calculated again: we cannot recognise you on another day, link your visits across days, or link a visit here with one on pythonandvba.com. Your IP address is used only for that calculation, for the country lookup, to leave out requests that come from hosting providers' networks (automated traffic rather than people), and for a short-lived counter that blocks abuse. It is not stored in the analytics records, and the server does not write these messages to its logs.
Nothing is stored on your device, and nothing is read from it beyond what every request carries anyway (not even the screen size). The records stay on our own server, which runs at Hetzner in Germany like the rest of TablePop (section 3). They are not shared with anyone or sold, and each record is deleted after 13 months.
If you start a purchase on our checkout (buy.pythonandvba.com) on the same day, the checkout calculates the same identifier from its own request and keeps where that visit came from (for example the referring website, a campaign and the page you landed on) with your checkout record, so we can see which pages and sources lead to purchases.
We do this for our legitimate interest in learning, with as little data as possible, how people find TablePop and which of these pages help them (Art. 6(1)(f) GDPR). You can object by writing to support@tablepop.app, or stop it yourself by blocking requests to api.pythonandvba.com/e in your browser, for example with a content blocker. TablePop works the same either way.
2. What we do not collect
- No tracking cookies on published pages. A visitor reading one of your tables gets no cookie from us, with one exception: after entering the password of a password-protected page, the browser keeps one strictly necessary cookie for that page, so the reader does not have to type the password again. It holds no personal data and expires after 7 days.
- No third-party analytics. Not on published pages, not on the dashboard, not on this page. No Google Analytics, no pixels, no tag manager. TablePop's own pages on tablepop.app count visits with our own cookieless system instead (see Visits to tablepop.app itself).
- No telemetry in the Excel add-in. No analytics and no automatic error reporting. Each request it makes names the add-in version, which is how account activity knows it.
- No visitor profiles. We count views of published pages as a number that goes up. We do not store who viewed, from where, on what, or in what order. One exception: a wrong password on a password-protected page is counted against the reader's IP address (for IPv6, its network) for up to three hours, so nobody can guess passwords at speed.
- No advertising, ever. We do not sell, rent or share personal data with anyone for marketing, and we never will. There is no version of this business where that makes sense.
About that view counter
Each published page has a counter so you can see whether anyone is reading it. It is a number per page and per day. It is not tied to an identifier, a session or an IP address, and it cannot be turned back into a list of visitors, by us or by anyone else.
3. Who else processes it
Six companies, each doing one specific job.
| Hetzner | Hosts the application and its database, on servers in Nuremberg, Germany. This is where your account, your sessions and your published tables live, and the visit records of tablepop.app's own pages. |
|---|---|
| Cloudflare | Serves every published page from locations around the world, and issues the TLS certificates, also for custom domains. A copy of every published page (public, unlisted or password-protected) and its images sits on Cloudflare's network so it loads quickly for your readers. Cloudflare handles each reader's request, including their IP address, and keeps short-lived request logs for us. It also stores our nightly database backups (see section 6), encrypted at rest by Cloudflare. |
| Postmark | Sends the emails TablePop itself sends: verification and password-reset codes, notices about your plan, and our own internal emails. They process your email address to deliver them. Purchase emails and license keys come from our checkout on pythonandvba.com. |
| Stripe and PayPal | Our payment providers: Stripe for cards, Apple Pay and Google Pay, and PayPal where it is offered. When you buy a paid plan, the payment provider you choose receives your payment details directly. Card details never reach TablePop. The checkout on pythonandvba.com is run by Bosau Digital LLC, like TablePop, and keeps your email address, name, country and invoices. TablePop learns from your license key which plan it unlocks and when the subscription renews or ends. |
| Only if you choose Continue with Google: Google confirms who you are and tells us your account's ID, email address and name. The sign-in itself happens at Google, under Google's own privacy policy. |
That is the complete list. Our license service and checkout on pythonandvba.com, and the visit counting on api.pythonandvba.com, are run by us, not by another company. If the list ever changes, this page changes with it.
4. Where your data is
We are a US company. The application and its database run on servers in Germany. Cloudflare, Postmark and, if you use Continue with Google, Google process data in the United States and elsewhere, and the payment providers do the same for payments. Where the law requires it, these transfers rely on the providers' data processing terms (EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework).
5. Cookies
The dashboard at my.tablepop.app sets one cookie to keep you signed in:
your session. While you create an account, it also sets a short-lived cookie that ties
the emailed code to your sign-up, and Continue with Google sets one that protects the
sign-in; both expire after ten minutes. All of them are strictly necessary, so there is
no consent banner to click away. None is used for tracking, and none follows you
anywhere else.
The visit counting on tablepop.app's own pages sets no cookie and stores nothing in your browser, so it needs no consent banner either.
A password-protected page sets one cookie on its own address after a reader enters the correct password. It only proves that the password was entered, expires after 7 days, and is never used for tracking. Other published pages set no cookie.
If you or a reader switch the dashboard or a published page between light and dark, the browser remembers that choice in its own storage. It is never sent to us.
6. How long we keep things
- Delete a page and it stops being served within about a minute. The stored payload is removed, and the edge copy is dropped. Its address stops working.
- Backups age out. We keep backups of the database so an outage does not lose your work: two nightly copies, each kept for 30 days on Cloudflare, with the newest few (up to 7 days) also on our server, and a snapshot before each database migration, of which the ten newest are kept. Deleted data can survive in those until they age out. We do not restore deleted pages from backups on request.
- Earlier versions of a page: we keep the last 10. Older ones are removed as new ones arrive, and all of them go when you delete the page.
- View counts are deleted after 400 days.
- Visit records of tablepop.app's own pages are deleted after 13 months; the daily random value behind their anonymous identifier, within two days.
- Email codes for sign-up and password resets expire ten minutes after they are sent.
- Account activity is deleted after two years. When you delete your account, it is unlinked from you: only anonymous counts remain, such as how many pages were published on a day.
- Sessions end 7 days after you sign in to the dashboard and 90 days after you sign in to the Excel add-in, or sooner if you sign out or sign them out on the Account page. Resetting a forgotten password signs out every session.
- Abuse reports in our database are kept while they are open and deleted two years after they are resolved.
- Your account is kept while you have one. Delete it yourself on the Account page in the dashboard, or email support@tablepop.app and we will delete it and everything attached to it. What stays: activity counts no longer linked to you, the admin log of any action we took on the account, abuse reports about your pages, backups until they age out, and the purchase records our checkout must keep for tax law.
7. Why we are allowed to hold it
Under the GDPR, we process your account details and your tables because we need them to provide the service you asked for · that is the contract basis. We keep account activity, the sign-up source, support notes, the admin log, our internal summary emails and security records (sign-ins, rate limits, wrong page passwords) for our legitimate interests: running and improving the service, keeping it safe, and not letting TablePop be used for phishing. The visit counting on tablepop.app's own pages rests on the same basis, our legitimate interest (Art. 6(1)(f) GDPR) in learning how people find TablePop. Abuse reports are handled for the same interest and for our legal duties as a host. Purchase records are kept because tax law requires it. There is no processing based on consent, because there is nothing optional to consent to.
8. Your rights
If you are in the EU, the UK, or anywhere with comparable law, you can ask us to show you what we hold, correct it, delete it, restrict its use, or hand it over in a portable form. You can object to our processing. You can complain to a data protection supervisory authority in the EU, such as the one where you live or work, or in the UK to the Information Commissioner's Office (ICO).
In practice, most of it is already in your hands: your pages are listed in the dashboard, you can edit or delete any of them yourself, and the Account page shows your sessions and lets you delete your account. For anything else, email support@tablepop.app. This is a small business · you will get a real reply, normally within a couple of days and always within one month.
9. Security, honestly stated
Traffic is encrypted in transit. Passwords, page passwords and session tokens are stored only as hashes. Published payloads are size-capped and rate-limited. Access to the production systems is limited to one person.
No system is perfect, and we will not pretend otherwise. If something goes wrong that affects your data, we will tell you what happened rather than wait to be asked.
10. Children
TablePop is a business tool and is not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.
11. Changes
If this page changes in a way that matters, the effective date at the top changes and, for anything significant, we will email account holders. We will not quietly broaden what we do with your data.
12. Contact
Bosau Digital LLC (trading as Python & VBA)
1209 Mountain Road Pl NE Ste N, Albuquerque, NM 87110, United States
Contact: Sven Bosau
Privacy and support: support@tablepop.app
Abusive or illegal pages: the form on Report a page, or
abuse@tablepop.app