Sheetspin

Most websites need a backend for the same handful of things: a contact form, a blog, some FAQs, maybe a gallery, a newsletter signup. But setting one up usually means picking a database, renting a server, configuring auth, and writing API routes — before you've even thought about your actual site.

The alternatives aren't much better. A paid SaaS owns your data and charges you monthly. A DIY server demands ongoing maintenance. A patchwork of separate tools doesn't talk to itself.

Sheetspin takes a different approach. Instead of provisioning infrastructure, it provisions a Google Sheet.

How it works

You sign in with Google, pick a template (or start blank), and Sheetspin spins up a Drive folder containing a Google Sheet with the right tabs pre-built — plus a single Google Apps Script deployed as your live API endpoint. The whole thing takes about two minutes.

• No server
• No monthly bill
• No lock-in — the Sheet and the script live entirely in your Google account
• No Sheetspin database — we never see or store your data

Provisioning happens directly from your browser using your own short-lived OAuth token. Nothing routes through our servers. The resources created are yours, full stop.

What you get

• Contact form — submissions land in a spreadsheet row and fire an email notification, with built-in honeypot spam protection and rate limiting
• Newsletter — collect email signups in a dedicated tab
• Blog — posts are rows you can edit directly in Sheets, served as JSON via your endpoint
• FAQs — question, answer, category, and order. Exactly what you need, nothing more
• Gallery — link Drive images to captioned rows
• Calendar / Events — date-structured rows returned as a sorted JSON array
• Asset storage — a Drive subfolder you upload to directly; the API lists whatever's there
• Site config — key-value pairs for tagline, social links, and other site-wide settings

Add or remove modules anytime

The endpoint never moves. Your Apps Script reads a live _manifest tab on every request — so when you add a module, remove one, or change form fields, there's nothing to redeploy. The URL you put in your site code on day one is the URL you'll use forever.

To keep things fast, the script caches the manifest for five minutes and tab data for an hour using Google's built-in CacheService. An onEdit trigger clears the cache automatically whenever you touch a cell, so changes propagate to your live site within seconds.

Built to be safe by default

Your API endpoint is public — static sites need to call it without a server — so Sheetspin hardens it in several ways. Every request requires a secret token. Form tabs are write-only, so submissions can never be read back through the API. Internal tabs (anything prefixed with _) are always blocked. Form submissions are rate-limited to 500 per hour per tab. And if you set an optional write password to enable content management, it's hashed in your browser before it ever leaves — Sheetspin never sees it.

An AI-friendly skill file

Once your site is provisioned, you can export a sheetspin.md file from the Site Kit. Drop it into your project and your AI coding assistant will understand your entire backend — endpoint URL, every module's schema, calling conventions, response formats, write actions — without any extra configuration.

Why we built it

We kept building the same backend for small sites and wanted a better answer than "just use a headless CMS with a paid tier." Now you can have a real, functioning backend in about two minutes, and it's yours forever.

Try it at [sheetspin.com](https://sheetspin.com).