Privacy notice

Personal Data and Sharing Check is a Google Workspace™ editor add-on for Google Sheets™, published by AppGarden. This notice sets out exactly which Google user data the add-on accesses, how it uses that data, who it is shared with, how it is protected, and how long it is kept and how to delete it. In short: your spreadsheet’s content is read in your browser and never sent to us or anyone else.

1. What Google user data the add-on accesses

The add-on accesses only the following Google user data, and nothing else:

• The contents of the one spreadsheet you have open, through the spreadsheets.currentonly scope: cell values, formulas, notes, formatting, hidden rows, columns and tabs, protections, data validation, named ranges and tab names. It cannot see any other spreadsheet or file in your Google Drive™.
• The spreadsheet’s share list: the email addresses of its owner, editors and viewers, read through the same scope.
• Apps Script™ user properties (storage tied to your Google account, for this add-on only): your licence record, your settings, and a one-off flag the menu sets so the sidebar opens on the right tab.
• Apps Script™ document properties (storage tied to the spreadsheet, for this add-on only): findings you chose to ignore (where they are and the reason you typed), and any detection patterns you save.

The add-on does not access your Gmail™, Calendar, contacts, Google Drive™ files other than the open spreadsheet, or any other Google service.

Scopes requested, and why

The add-on requests no Drive, Gmail™ or contacts scope. It cannot see or change a file’s link-sharing settings.

2. How the add-on uses Google user data

• Spreadsheet contents are read only when you run a check or a Find-a-person search, to detect personal data and show you where it is. Detection, masking previews and the search all run in the add-on’s sidebar, in your browser.
• The share list is used only to show you who can already open the file, before you share it further.
• Fixes are written only when you apply them, and only to the cells, notes and validation rules the preview showed you. If you choose copy and redact, the add-on makes a copy of the spreadsheet in your own Drive and redacts the copy; the copy is not shared with anyone.
• Report tabs you ask for are written into the same spreadsheet.
• Properties are used to remember your licence, settings, ignored findings and saved patterns.

This add-on’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on’s user-facing features described above. It is not used for advertising, is not sold, is not used to develop, improve or train generalised or non-personalised AI or machine-learning models, and is never sent to a third-party AI service. No human reads it.

3. Who Google user data is shared with, transferred to or disclosed to

No one. AppGarden does not share, transfer, sell or disclose Google user data to any third party. Cell values, findings, file names and the email addresses of anyone the file is shared with are never sent outside Google.

The add-on’s only network traffic is a licence check to AppGarden’s licence server. Activating Pro sends a licence key, an opaque random install id and the host (“sheets”); later checks also send the activation id the server issued. None of these is derived from you, your files or your collaborators, and none is Google user data. The only exception to “no one” would be where the law requires disclosure, and even then AppGarden holds no Google user data to disclose.

Paddle.com Market Limited is the merchant of record for purchases and handles payment, tax and refunds under its own privacy policy; card details never touch AppGarden. When you buy, the licence server looks up your email address from Paddle once to send your key, through the email provider Resend; that address comes from Paddle, not Google, and is not stored. Support emails receive only what you choose to send, and we ask for screenshots, never files.

4. How Google user data is secured and protected

• Least privilege. The add-on requests only spreadsheets.currentonly and script.container.ui, so it can reach only the spreadsheet it is opened in, never the rest of your Drive.
• Data stays inside Google. Spreadsheet data is processed only within Google Sheets™, Google Apps Script™ and the sidebar in your browser. It is not stored on any AppGarden server, so there is no copy of it outside Google to leak.
• Google’s own protection. Your spreadsheet, any redacted copy and the Apps Script™ properties are stored by Google and protected by your Google account’s access controls. User properties are readable only by this add-on running as you; document properties only by this add-on in that spreadsheet.
• No third-party code in the sidebar. The sidebar loads no analytics, advertising, tracking or externally hosted scripts.
• Encrypted connections. The licence check uses HTTPS (TLS) only.
• Error logs. If the add-on hits an error, Google records it in the add-on’s own Google Cloud™ logs so the fault can be fixed. The add-on’s errors carry fixed codes, never cell values, names or addresses. Only AppGarden can see these logs, and Google deletes them after its standard retention period.
• Restricted access to licence records. The licence server runs on Cloudflare, which encrypts stored data at rest. Only AppGarden can reach its records, which hold licence keys, subscription status, seat assignments (install ids) and expiry dates — never spreadsheet content, findings or collaborator addresses. Payment and email credentials are held as encrypted secrets, never in the add-on’s code.
• If something goes wrong. If AppGarden becomes aware of a security incident affecting any data it holds, it will notify affected users without undue delay, and the UK Information Commissioner’s Office where the law requires it.

5. Retention and deletion of Google user data

• Spreadsheet contents and the share list are held only in memory while the sidebar is open, and are discarded when you close it. AppGarden retains none.
• Report tabs stay in your spreadsheet until you delete them or use “Remove PDS tabs”. Redacted copies stay in your Drive until you delete them.
• Ignored findings and saved patterns (document properties) stay with the spreadsheet until the spreadsheet is deleted; email us and we will tell you how to clear them sooner.
• User properties (licence record, settings) are kept until you remove them; the menu’s one-off flag is deleted as soon as the sidebar reads it. The sidebar also keeps a copy of the licence record and a “welcome screen seen” flag in its own browser storage, which your browser keeps until you clear it. You can remove the add-on’s access at any time at myaccount.google.com/permissions.
• AppGarden’s licence server keeps a key, its status, seats and expiry until you ask for them to be deleted once no subscription needs them. This is not Google user data. Email support@appgarden.co.uk from the address you paid with; deletion requests are completed within 30 days.

A note on GDPR

The add-on isn’t a processor of the personal data in your spreadsheets, because it never receives it — processing happens in your browser, on your machine, under your control. You remain the controller of your files. This paragraph isn’t legal advice; your DPO or the ICO’s guidance is the reference for your obligations.

Your rights

Email support@appgarden.co.uk to ask what is held against a licence key, to correct it, or to have it deleted.

Changes to this notice

If this notice changes materially, the date below is updated and the change is described here.

Last updated: 25 September 2026.

Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Personal Data and Sharing Check is not affiliated with or endorsed by Google.