Privacy notice

Hardcoded Value Detector is a Google Workspace™ editor add-on for Google Sheets™, published by AppGarden. This notice sets out exactly which Google user data the add-on accesses, how it uses that data, who it is shared with, how it is protected, and how long it is kept and how to delete it, in line with Google's API Services User Data Policy.

1. What Google user data the add-on accesses

The add-on accesses only the following Google user data, and nothing else:

• The contents of the one spreadsheet you have open, through the spreadsheets.currentonly scope: cell values, formulas, number formats and sheet (tab) names. It cannot see or touch any other spreadsheet in your Drive.
• Apps Script™ document properties (storage tied to the spreadsheet): the restore points for fixes you apply — each changed cell's original value and number format.
• Apps Script™ user properties (storage tied to your Google account): your licence record — the licence key, an anonymous install id, the host and the tier it activates — and your settings.

The add-on does not access your name, email address, Gmail™, other files in your Google Drive™, or any other Google service.

Scopes requested, and why

The add-on does not request Drive-wide access, Gmail™ access, or access to any other Google service.

2. How the add-on uses Google user data

• Spreadsheet contents are read only when you start a check, and the check runs inside the sidebar in your browser. Cells are written only when you apply a fix, and only the cells the preview showed you.
• Restore points: before a fix writes a cell, the add-on saves that cell's original value and number format in the spreadsheet's document properties, so Undo can write the original back.
• Report: an exported report is written to a tab inside the same spreadsheet. It never leaves it.
• User properties are used to remember your licence and settings.

This add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's own user-facing features described above, and only with your knowledge and action — running a check or a fix. It is not used for advertising, is not sold, rented or otherwise monetised, and is not used to develop, improve or train generalised or non-personalised AI or machine-learning models. It is never sent to, or processed by, any third-party AI or machine-learning service. No human reads it.

3. Who Google user data is shared with, transferred to or disclosed to

No one. AppGarden does not share, transfer, sell or disclose Google user data to any third party. Your spreadsheet content — cell values, formulas, sheet names — and file identifiers are never transmitted anywhere, never copied to a server this add-on or AppGarden operates, and never logged.

The add-on's only network traffic is a licence check to AppGarden's licence server. It sends your licence key (if you have one), an anonymous install id generated on your machine, which host this is (Excel or Google Sheets™, so support can tell seats apart), and, once activated, an opaque instance id the server itself assigned so it can tell activations apart. No spreadsheet content, Google account identifier or other Google user data is ever included. The only exception to “no one” would be where the law requires disclosure, and even then AppGarden holds no Google user data to disclose.

Paddle.com Market Limited is the merchant of record for all purchases and handles payment processing, tax and refunds under its own privacy policy. AppGarden never sees or stores your card details. Paddle receives what you enter at checkout; it receives no Google user data from the add-on.

4. How Google user data is secured and protected

• It stays on Google's infrastructure. Spreadsheet data travels only between Google's servers and the add-on's sidebar in your browser, over Google's own encrypted (HTTPS/TLS) connections. The sidebar runs inside Google's Apps Script™ HtmlService sandbox. AppGarden operates no server that receives, processes or stores Google user data, so there is no copy of it outside Google to be breached.
• Least-privilege access. The add-on requests only the spreadsheets.currentonly scope, so it can reach the one spreadsheet you open it in and nothing else in your Drive or Google account. It runs only when you open it, and reads the sheet only when you start a check or a fix.
• Protected by your own Google permissions. Restore points and an exported report live inside the same spreadsheet and carry exactly the same sharing permissions and Google security as the spreadsheet itself; neither ever leaves it. The licence record is held in Apps Script™ user properties, which Google stores against your account and makes readable only to this add-on running as you.
• No third-party code in the sidebar. The sidebar loads no analytics, advertising, tracking or externally hosted scripts; all of its code ships with the add-on.
• The licence server is encrypted and holds no Google data. Licence checks go over HTTPS only. The server stores the licence key, install id, host and tier and nothing from your spreadsheets or Google account. Its payment and email credentials are held as encrypted secrets, never in source code, and administrative access is limited to AppGarden.
• If something goes wrong. If AppGarden becomes aware of a security incident affecting any user's data, it will notify the affected users, and Google where required, without undue delay and take steps to contain it.

5. Retention and deletion of Google user data

• Spreadsheet contents read during a check are held only in the sidebar's memory while it is open. AppGarden retains none.
• Restore points live in the spreadsheet itself and go when you delete the spreadsheet.
• User properties hold only the key, install id, host, tier and your settings — never spreadsheet content — and are readable only by this add-on running as you. Uninstalling stops the add-on from running; Google does not delete this record at uninstall, so if you want it gone, email us and we will revoke the key, after which the stored copy no longer activates anything. You can remove the add-on's access at any time at myaccount.google.com/permissions.
• AppGarden's licence server keeps the licence key, install id, host and tier for as long as the licence is in use — no name, no email address beyond what Paddle needs to process payment and send a receipt, and no spreadsheet content of any kind. Email support@appgarden.co.uk to have it deleted; deletion requests are completed within 30 days.
• The launch waitlist (deleted). Before launch, people could leave an email address on the product page. The whole list, addresses and timestamps, was deleted on 28 September 2026 without being used.

Your rights

Email support@appgarden.co.uk to ask what is held against a licence key, or to have it deleted.

Changes to this notice

If this notice changes materially, the date below is updated and the change is described here.

Last updated: 25 September 2026 — added an explicit statement that Google user data is never sent to or processed by any third-party AI or machine-learning service, and corrected the description of the licence server's network traffic to include the server-assigned instance id sent on activation and refresh.

Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Excel is a trademark of Microsoft Corporation. Hardcoded Value Detector is not affiliated with or endorsed by Google or Microsoft.