Privacy notice

Shared Sheet Guardrails is a Google Workspace™ editor add-on for Google Sheets™, published by AppGarden. This notice sets out exactly which Google user data the add-on accesses, how it uses that data, who it is shared with, how it is protected, and how long it is kept and how to delete it. It is not affiliated with or endorsed by Google.

Google user data at a glance

• What it accesses: the contents of the one spreadsheet you open it in (cells, formulas, protections, validation rules, tab names) and the email addresses of that spreadsheet's owner, editors and protected-range editors. Nothing else in your Google account. Details in section 1.
• What it does with it: checks the sheet and sets up, fixes or removes guardrails, only when you ask, and only to provide those features. It is never used for advertising or to train AI or machine-learning models. Details in section 2.
• Who gets it: no one. It is never sent to AppGarden or any third party. Details in section 3.
• How it is protected and deleted: it stays inside Google's own infrastructure, and you can remove what the add-on stored at any time. Section 4 and section 5.
• Limited Use: use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Full statement in section 2.

1. What Google user data the add-on accesses

The add-on accesses only the following Google user data, and nothing else:

• The contents of the one spreadsheet you have open, through the spreadsheets.currentonly scope: cell values, formulas, number formats, merges, filters, frozen rows, notes, protected ranges, data validation and conditional formatting rules, and sheet (tab) names. It cannot see any other spreadsheet or file in your Google Drive™.
• Email addresses on that spreadsheet: the addresses of the spreadsheet's owner and editors and of the people named on its protected ranges. The add-on also asks Google for your own address, but Google does not provide it for these scopes, so it is never received or stored.
• Apps Script™ document properties (storage tied to the spreadsheet, for this add-on only): your saved setup (the “contract”) and the restore points that make Undo work.
• Apps Script™ user properties (storage tied to your Google account, for this add-on only): your licence record, and a one-off flag the Check this sheet menu item sets so the sidebar opens on the Check tab.

The add-on does not access your Gmail™, Calendar, contacts, Google Drive™ files other than the open spreadsheet, the file's link-sharing settings, or any other Google service.

Scopes requested, and why

The add-on does not request Drive-wide access, Gmail™ access, or access to any other Google service. That is also why it cannot see or change a file's link-sharing settings: that would need broader Drive access than this add-on asks for.

2. How the add-on uses Google user data

• Spreadsheet contents are read only when you start a check, a setup, a fix or a removal, to check the sheet and explain the findings in the sidebar. They are written only when you confirm a setup, click a fix, Undo or Remove guardrails, and only to change what that action names.
• Email addresses: owner and editor addresses are read only to flag protections that name people no longer on the file. Locked areas stay editable by the file owner, whose address anchors the lock (your own is asked for but not provided, as above). Addresses of editors you name for a locked area are saved in the contract so the setup can be repeated.
• The contract and restore points are used to re-check the sheet against your setup, and to undo or remove what the add-on set up. The contract also records the anonymous install id of whoever set it up.
• Tabs written: the optional Sheet rules tab, a Moved by guardrails tab if a fix moves entries aside, and report tabs if you ask for one. Download CSV and contract export create a file in your browser and save it straight to your own device; it is not sent anywhere.

Every check runs in the add-on's sidebar in your browser; reads and writes go through Google Apps Script™ on your own account. Your spreadsheet content is never transmitted to any server AppGarden operates and never seen by anyone but you. The one exception is an error message, described under how data is protected: it carries an error code, never cell content.

This add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's user-facing features described above. It is not used for advertising, is not sold, rented or otherwise monetised, is not used to develop, improve or train AI or machine-learning models, generalised or otherwise, and is never sent to a third-party AI service. No human reads it.

3. Who Google user data is shared with, transferred to or disclosed to

No one. AppGarden does not share, transfer, sell or disclose Google user data to any third party. Your spreadsheet content, email addresses, sheet names and file identifiers are never sent outside Google.

Your collaborators do not install the add-on. The guardrails are ordinary Google Sheets™ features (protected ranges, data validation, conditional formatting, frozen rows and notes) inside the spreadsheet, so nothing about your collaborators is sent to AppGarden or anyone else.

The add-on's only network traffic is to AppGarden's licence server, and to the page you land on straight after checkout:

• Activating or checking a licence sends your licence key, an anonymous install id generated in your browser, and which kind of add-on is asking (“sheets”); later checks also send back the activation id the server issued for that key.
• The post-checkout claim page (a plain web page, separate from the sidebar) sends Paddle's transaction id to fetch the key that was just purchased.

None of this is Google user data, and no spreadsheet content, cell values, sheet names, email addresses or file identifiers are ever included. The only exception to “no one” would be where the law requires disclosure, and even then AppGarden holds no Google user data to disclose.

Paddle.com Market Limited is the merchant of record for all purchases and handles payment processing, tax and refunds under its own privacy policy. AppGarden never sees or stores your card details. When you buy, the licence server looks up your email address from Paddle once to send your key, through the email provider Resend; that address comes from Paddle, not Google, and is not stored. Paddle receives no Google user data from the add-on.

4. How Google user data is secured and protected

• It stays on Google's infrastructure. Spreadsheet data travels only between Google's servers, the add-on's Apps Script™ (which Google runs), and the add-on's sidebar in your browser, over Google's own encrypted (HTTPS/TLS) connections. The sidebar runs inside Google's Apps Script™ HtmlService sandbox. AppGarden operates no server that receives, processes or stores Google user data, so there is no copy of it outside Google to be breached.
• Least-privilege access. The add-on requests only the spreadsheets.currentonly and script.container.ui scopes, so it can reach the one spreadsheet you open it in and nothing else in your Drive or Google account. It runs only when you open it, and reads the sheet only when you start a check, a setup, a fix or a removal. It installs no triggers and never runs in the background.
• Protected by your own Google permissions. Everything the add-on keeps in the spreadsheet — the guardrails, the Sheet rules, Moved by guardrails and report tabs, the saved contract and the restore points — carries exactly the same sharing permissions and Google security as the spreadsheet itself: people who can open the spreadsheet can reach it, and no one else can. The licence record is held in Apps Script™ user properties, which Google stores against your account and makes readable only to this add-on running as you.
• No third-party code in the sidebar. The sidebar loads no analytics, advertising, tracking or externally hosted scripts; all of its code ships with the add-on.
• Error logs. If the add-on hits an error, Google records the error in the add-on's own Google Cloud™ logs so the fault can be fixed. The add-on's errors carry a code, never cell content. Only AppGarden can see these logs, Google deletes them automatically after its standard retention period, and they are never exported or shared.
• The licence server is encrypted and holds no Google data. Licence checks go over HTTPS only. The server runs on Cloudflare's infrastructure, which encrypts stored data at rest, and stores the licence key, its tier and status, and the install ids and activation dates of the installs using it — nothing from your spreadsheets or Google account. Its payment and email credentials are held as encrypted secrets, never in source code, and administrative access is limited to AppGarden. Paddle webhook events are verified by signature before they can change a licence record.
• Safe exports. Every CSV field beginning =, +, - or @ is prefixed so it cannot run as a formula.
• If something goes wrong. If AppGarden becomes aware of a security incident affecting any user's data, it will notify the affected users, and Google and the UK Information Commissioner's Office where required, without undue delay and take steps to contain it.

5. Retention and deletion of Google user data

• Spreadsheet contents read during a check are held only in memory while the sidebar is open, and are discarded when you close it. AppGarden retains none.
• Guardrails, the contract and restore points stay in your spreadsheet until you remove them. Remove guardrails deletes the guardrails the add-on added, along with its saved contract and restore points; it is free in every tier. Uninstalling the add-on does not remove them on its own, so run Remove guardrails before you uninstall.
• Tabs: report tabs are removed with Remove report tabs or by deleting them. Remove guardrails never deletes a Moved by guardrails tab, because that tab holds your own data: delete it yourself when you no longer need it. Deleting the spreadsheet deletes all of it.
• User properties (licence record) are kept until you remove the licence in the sidebar; the Check this sheet flag is deleted as soon as the sidebar reads it. The sidebar also keeps a copy of the licence record and a “welcome screen seen” flag in its own browser storage, which your browser keeps until you clear it. You can remove the add-on's access at any time at myaccount.google.com/permissions.
• AppGarden's licence server keeps your licence key, tier, status, install ids and activation dates until you ask for them to be deleted. This is not Google user data. Email support@appgarden.co.uk to see or delete it; deletion requests are completed within 30 days.

Your rights

Email support@appgarden.co.uk to ask what is held against a licence key, to correct it, or to have it deleted. You can also revoke the add-on's access to your Google account at any time from myaccount.google.com/permissions. Uninstalling the add-on and removing its access there stops it reading any further Google user data immediately.

Changes to this notice

If this notice changes materially, the date below is updated and the change is described here. Continuing to use the add-on after a change means you accept the update.

Last updated: 4 October 2026 — added a “Google user data at a glance” summary at the top; no change to what is accessed or how it is used. Previously, 28 September 2026: your own email address is asked for but not provided by Google.

First published 23 September 2026, including how Google user data is secured and protected.

Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Shared Sheet Guardrails is not affiliated with or endorsed by Google.