Before you upload anything, the short version:

• We never see your workbook data. Tableau passes it to the extension inside the browser; it doesn't travel through us.
• But extension code can send data anywhere once it holds your rows, so what you're trusting is the code, not the host. We scan it and publish what we find.
• Anything in your extension's files is public to anyone with the link. Never put an API key or password in one.
• We store your files and can read them, and we record which Tableau site loads your extension (the hostname, never workbook content).
• This is early software. Don't host anything you can't afford to lose.