Privacy notice

Two-File Reconciliation is a Google Workspace™ editor add-on for Google Sheets™, published by AppGarden. This notice sets out exactly which Google user data the add-on accesses, how it uses that data, who it is shared with, how it is protected, and how long it is kept and how to delete it.

1. What Google user data the add-on accesses

The add-on accesses only the following Google user data, and nothing else:

• The contents of the one spreadsheet you have open, through the spreadsheets.currentonly scope: the list of its tabs and named ranges, your current selection, the spreadsheet's time zone and name, and the values, formulas and number formats of the two tables you pick to reconcile. After a report is written, it also reads back the Accept? checkboxes on the report's Review tab when you press Apply review.
• Apps Script™ user properties (storage tied to your Google account, for this add-on only): your licence entitlement record, an anonymous install id, and any recipes saved under My recipes.
• Apps Script™ document properties (storage tied to the spreadsheet, for this add-on only): any recipes saved In this spreadsheet, and, only while a report is being written, a short-lived record of the tabs that run has created.
• Apps Script™ user cache (storage tied to your Google account, expires after 60 seconds): a one-shot hint that the sidebar should open on the recipe list, set when you use the Run a saved recipe… menu item.

The add-on does not access your name, email address, contacts, Gmail™, Calendar, Google Drive™ files other than the open spreadsheet, or any other Google service. A second table in another spreadsheet has to be copied in or loaded as a CSV file in your browser; the add-on cannot open another file on its own.

Scopes requested, and why

These are the only two scopes in the add-on's manifest. It does not request Drive-wide access, Gmail™ access, or access to any other Google service.

2. How the add-on uses Google user data

• Spreadsheet contents are read only when you pick your two tables and run a reconciliation, to match them and show you the result. The matching itself runs in the sidebar, in your browser, against a plain copy of the two tables – not on any server. Rows are written back only when you ask for the report, and only as new tabs (Summary, Review, Audit and the matched/unmatched tabs) in the same spreadsheet. The source tabs you picked from are never modified.
• A CSV you load as the second table is read and parsed in your browser and uploaded nowhere. Download as CSV builds the file in your browser and saves it to your computer; it is never sent to a server either.
• A recipe you save holds the column mapping, the settings, the names of the source tabs or ranges and any key pairs you accepted on a Review tab, so it can be run again later – by you, or by whoever you share it with.
• User properties are used to remember your licence entitlement, install id and saved recipes across spreadsheets.

All processing happens inside Google: in the add-on's sidebar in your browser and in Google Apps Script™ on your own account. Your spreadsheet content is never transmitted to any server AppGarden operates and never seen by anyone but you.

This add-on's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the add-on's user-facing features described above. It is not sold, not used for advertising, and not used to develop, improve or train generalised or non-personalised AI or machine-learning models. No human reads it, and it is never sent to a third-party AI or machine-learning service.

3. Who Google user data is shared with, transferred to or disclosed to

No one. AppGarden does not share, transfer, sell or disclose Google user data to any third party. Your spreadsheet content, tab names, named ranges and file identifiers are never sent outside Google. A recipe saved In this spreadsheet can be seen by the spreadsheet's own collaborators, which is the purpose of that option, and is never sent anywhere else.

The add-on's only network traffic is a licence check to AppGarden's licence server, made with fetch() from the sidebar (this add-on never calls UrlFetchApp from Apps Script™). Activating or checking a licence sends your licence key, an anonymous install id generated for your Google account, and which host (Excel or Google Sheets™) it was activated from; once a key is activated, the check also carries the activation id the server issued for it. That is the entire network footprint of this add-on – no spreadsheet content, no cell values, no tab names and no file identifiers are ever included. The only exception to “no one” would be where the law requires disclosure, and even then AppGarden holds no Google user data to disclose.

Paddle.com Market Limited is the merchant of record for all purchases and handles payment processing, tax and refunds under its own privacy policy. Paddle receives what you enter at checkout; it receives no Google user data from the add-on. When you buy, the licence server looks up your email address from Paddle once, to send your key through the email provider Resend; the address itself is not stored. The same licence server serves the Excel version of this add-on, so a key used in both is one record.

4. How Google user data is secured and protected

• It stays on Google's infrastructure. Spreadsheet data travels only between Google's servers and the add-on's sidebar in your browser, over Google's own encrypted (HTTPS/TLS) connections. The sidebar runs inside Google's Apps Script™ HtmlService sandbox. AppGarden operates no server that receives, processes or stores Google user data, so there is no copy of it outside Google to be breached.
• Least-privilege access. The add-on requests only spreadsheets.currentonly and script.container.ui, so it can reach the one spreadsheet you open it in and nothing else in your Drive or Google account. It runs only when you open it, and reads the tables only when you ask it to.
• Protected by your own Google permissions. The report tabs and any recipe saved In this spreadsheet live inside the same spreadsheet, so they carry exactly the same sharing permissions and Google security as the spreadsheet itself: anyone who can open the spreadsheet can see them, and no one else can. My recipes, the install id and the licence entitlement are held in Apps Script™ user properties, which Google stores against your account and makes readable only to this add-on running as you.
• A small, local licence cache. The sidebar keeps a copy of your licence entitlement in the browser's own localStorage so it can check your tier instantly on load; it holds no spreadsheet content and is cleared when you deactivate the licence.
• No third-party code in the sidebar. The sidebar loads no analytics, advertising, tracking or externally hosted scripts. All of its code ships with the add-on.
• Error logs. If the add-on hits an error, Google records the error message in the add-on's own Google Cloud™ (Stackdriver) logs so faults can be fixed. Only AppGarden can see these logs, Google deletes them automatically after its standard retention period, and they are never exported or shared.
• Safe exports. Every field in a downloaded CSV report beginning =, +, - or @ is prefixed so it cannot run as a formula when the file is reopened.
• The licence server is encrypted and holds no Google data. Licence checks go over HTTPS only. It runs on Cloudflare's infrastructure, which encrypts stored data at rest, and stores only the licence key, the install ids it has been activated from, which host each was, and the tier – never spreadsheet content or anything else from your Google account. Its payment and email credentials are held as encrypted secrets, never in source code, and administrative access is limited to AppGarden.
• If something goes wrong. If AppGarden becomes aware of a security incident affecting any user's data, it will notify the affected users, and Google where required, without undue delay, and take steps to contain it.

5. Retention and deletion of Google user data

• Spreadsheet contents read during a reconciliation are held only in memory for as long as the sidebar is open, and are discarded when you close it. AppGarden retains none of it.
• Report tabs (Summary, Review, Audit and the matched/unmatched tabs) stay in your spreadsheet until you delete them yourself.
• The report-run record kept in document properties while a report is being written is deleted as soon as the write finishes, and dropped automatically after 24 hours in any case, whichever comes first.
• Recipes (My recipes and In this spreadsheet) are kept until you delete them with Delete in the sidebar, or, for My recipes, until you remove the add-on's access. Uninstalling the add-on does not by itself erase them, but they hold no data reachable once you have removed access.
• The install id and licence entitlement in your user properties are kept until you remove the add-on's access. You can do this at any time at myaccount.google.com/permissions, or email us and we will tell you how to clear them.
• AppGarden's licence server keeps your licence key, the install ids it has been activated from, the host and the tier for as long as the licence is in use. This is not Google user data. Email support@appgarden.co.uk to see what is held against a licence key, or to have it deleted.

Your rights

Email support@appgarden.co.uk to ask what is held against a licence key or install id, to correct it, or to have it deleted. You can also revoke the add-on's access to your Google account at any time from myaccount.google.com/permissions.

Changes to this notice

If this notice changes materially, the date below is updated and the change is described here. Continuing to use the add-on after a change means you accept the update.

Last updated: 25 September 2026. Restructured into the five sections Google's data safety review asks for (what is accessed, how it is used, who it is shared with, how it is protected, and retention and deletion), with the Limited Use statement made explicit.

Google, Google Sheets™ and Google Workspace™ are trademarks of Google LLC. Two-File Reconciliation is not affiliated with or endorsed by Google.