Privacy notice

Form Response Cleaner is a Google Workspace™ editor add-on for Google Sheets™, published by AppGarden. This notice sets out exactly which Google user data the add-on accesses, how it uses that data, who it is shared with, how it is protected, and how long it is kept and how to delete it. It is not affiliated with or endorsed by Google.

1. What Google user data the add-on accesses

The add-on accesses only the following Google user data, and nothing else:

• The contents of the one spreadsheet you have open, through the spreadsheets.currentonly scope: cell values, number formats, formulas, sheet (tab) names, and the linked Google Form™'s URL where one exists, on the responses tab you choose to clean. It cannot see any other spreadsheet or file in your Google Drive™.
• Apps Script™ user properties (storage tied to your Google account, for this add-on only): your licence record (key, install id, tier and activation dates).
• Apps Script™ document properties (storage tied to the spreadsheet, for this add-on only): saved recipes (frc.recipe.…), the record of which tabs the cleaner created and their fingerprint (frc.tabs.…).
• A flag in the sidebar's own browser storage (not synced anywhere): whether you have dismissed the first-run welcome screen.

The add-on does not access your name, email address, contacts, Gmail™, Calendar, the Google Form™ itself, Google Drive™ files other than the open spreadsheet, or any other Google service. It does not read Google Forms™ directly — it only reads the form's URL, when Sheets makes one available, to show it as a link. That is also why checkbox option lists are learned from your responses rather than read from the form: reading the form would need a broader scope than this add-on asks for.

Scopes requested, and why

2. How the add-on uses Google user data

• Response data is read only when you open the cleaner or click Check, Clean or Refresh, to detect columns, run the rules you have chosen and show you the result. It is written only to new tabs (Clean – …, Choices – …, Summary – …, Excluded – … and Cleaning log), grouped to the right of the responses tab. The responses tab Google Forms™ writes to is never written.
• Saved recipes record which rules and mappings you chose, so Refresh (by you or a collaborator) can re-run them without repeating the wizard. They never leave the spreadsheet's own properties.
• The tabs record and fingerprint let Refresh tell whether the managed tabs were hand-edited since the last run, and let “Remove cleaner tabs” find exactly what it created.
• User properties (your licence record) are used to check which features are unlocked, and are re-checked on every gated action.

All processing happens inside Google: in the add-on's sidebar in your browser and in Google Apps Script™ on your own account. Your spreadsheet content is never transmitted to any server AppGarden operates and never seen by anyone but you.

This add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's user-facing features described above. It is not used for advertising, is not sold, and is not used to develop, improve or train generalised or non-personalised AI or machine-learning models. No human reads it, and it is never sent to any third-party AI or machine-learning service.

3. Who Google user data is shared with, transferred to or disclosed to

No one. AppGarden does not share, transfer, sell or disclose Google user data to any third party. Your spreadsheet content, sheet names and file identifiers are never sent outside Google.

The add-on's only network traffic is to AppGarden's licence server, and to the page you land on straight after checkout:

• Activating or checking a licence sends your licence key (if you have one), an anonymous install id generated by the add-on, and which host it is running on (“sheets”). Refreshing also sends the install instance id the server issued at activation.
• The post-checkout claim page (a plain web page, separate from the sidebar) sends Paddle's transaction id to fetch the key that was just purchased.

None of this is Google user data, and no spreadsheet content, response data, sheet name or file identifier is ever included. The only exceptions to “no one” would be where the law requires disclosure, and even then AppGarden holds no Google user data to disclose.

Paddle.com Market Limited is the merchant of record for purchases and handles payment, tax and refunds under its own privacy policy. Paddle receives what you enter at checkout; it receives no Google user data from the add-on. When a licence key is first issued, AppGarden also emails it to the address Paddle holds for that purchase, using Resend as its email provider; that email address comes from Paddle, not from the add-on or your Google account, and is not stored by AppGarden's licence server.

4. How Google user data is secured and protected

• Least privilege. The add-on requests only spreadsheets.currentonly, so it can reach only the spreadsheet it is opened in, never the rest of your Drive.
• Data stays inside Google. Spreadsheet data is processed only within Google Sheets™, Google Apps Script™ and the sidebar in your browser. It is not stored on any AppGarden server, so there is no copy of it outside Google to leak.
• Google's own protection. Your spreadsheet and the Apps Script™ properties are stored by Google, encrypted in transit and at rest, and protected by your Google account's access controls. User properties are readable only by this add-on running as you; document properties only by this add-on in that spreadsheet.
• Encrypted connections. The licence check and the claim page use HTTPS (TLS) only.
• Restricted access to licence records. AppGarden's licence server runs on Cloudflare Workers with a Cloudflare KV store, which encrypts stored data at rest. Only AppGarden can reach its records, through its own Cloudflare account, and they hold a licence key, an anonymous install id, activation records, a subscription status and tier — never Google user data. Payment and email-sending keys are held as encrypted secrets on the server, never in the add-on's code. Paddle webhook events are verified by signature before they can change a licence record.
• Error logs. If the add-on hits an error, Google records the error message in the add-on's own Google Cloud™ logs so faults can be fixed. Only AppGarden can see these logs, Google deletes them automatically after its standard retention period, and they are never exported or shared.
• No sensitive data collected. AppGarden holds no spreadsheet content, no Google account identifiers and no card details (Paddle handles payment).
• If something goes wrong. If AppGarden becomes aware of a security incident affecting any data it holds, it will notify affected users without undue delay, and the UK Information Commissioner's Office where the law requires it.

5. Retention and deletion of Google user data

• Spreadsheet contents read during a check or clean are held only in memory for as long as the sidebar is open, or for the moment a server-side refresh runs, and are discarded straight after. AppGarden retains none.
• The Clean, Choices, Summary and Excluded tabs, and the Cleaning log, stay in your spreadsheet until you delete them yourself or use “Remove cleaner tabs”, which deletes every tab it created, the saved recipe for that responses tab, and the tabs record, all in one action, at any time, in every tier.
• Saved recipes and the tabs record (document properties) are kept until you remove them with “Remove cleaner tabs” or delete the spreadsheet, whichever comes first. Uninstalling the add-on does not delete them on its own, so run “Remove cleaner tabs” before you uninstall.
• User properties (your licence record) are kept until you remove them. You can remove the add-on's access at any time at myaccount.google.com/permissions, or email us and we will tell you how to clear them.
• AppGarden's licence server keeps your licence key, install id, activation records, subscription status and tier for as long as the licence is in use. This is not Google user data. Email support@appgarden.co.uk to see or delete it; deletion requests are completed within 30 days.

Your respondents' personal data

Form responses are often personal data: names, email addresses, phone numbers, sometimes children's data from school forms. AppGarden is not a processor of your respondents' data, because it never reaches us — cleaning happens entirely inside your browser, Google Apps Script™ and your spreadsheet. You, the form owner, remain the controller of that data under the UK GDPR, and nothing in how this add-on works changes that. If you email us a copy of a sheet for support, only send one you are content to share, and strip out what support does not need to see.

Payment information

Paddle.com Market Limited is the merchant of record for all purchases and handles payment processing, tax and refunds. AppGarden never sees or stores your card details. Paddle's own privacy policy covers what it collects during checkout.

Your rights

Email support@appgarden.co.uk to ask what is held against a licence key or install id, to correct it, or to have it deleted. Uninstalling the add-on and removing its access at myaccount.google.com/permissions stops it reading any further Google user data immediately.

Changes to this notice

If this notice changes materially, the date below is updated and the change is described here. Continuing to use the add-on after a change means you accept the update.

Last updated: 26 September 2026.

Google, Google Forms™, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Form Response Cleaner is not affiliated with or endorsed by Google.