← Notion Sync for Sheets™

Privacy Policy — Notion Sync for Sheets™

What this add-on does with your data

Notion Sync for Sheets™ keeps a Notion database and a Google Sheets tab in sync in both directions. To do that it reads and writes your Notion pages and your spreadsheet cells. This policy explains exactly what is stored where, and what (if anything) leaves your Google account.

Data stored in your Google account

The following is stored exclusively in Google's infrastructure within your own account, using Apps Script storage APIs. It never passes through Four Ducks servers.

• Notion OAuth access token — issued by Notion when you click "Connect Notion." Stored in User Properties (per-user, private to your Google account). Used to call the Notion API on your behalf.
• Notion workspace name — stored in User Properties alongside the token. Used only to display which workspace is connected.
• License key — if you have purchased a paid license, the key you enter is stored in User Properties. It is sent to Gumroad's API to validate your subscription (see "Third-party services" below).
• Link state per sheet — stored in Document Properties (tied to the specific spreadsheet). Contains: the linked Notion database ID and title, the names and Notion property types of each column (not the values), the last-sync timestamp, and a pagination resume cursor if a sync was interrupted. No Notion page content is here.
• Sync log — stored in a hidden sheet named _syncLog inside your spreadsheet. Each entry records: timestamp, sync direction (notion→sheets or sheets→notion), number of rows changed, number of conflicts, number of skips, and any error notes. No cell values or Notion page content are written to the sync log. The log auto-trims to 500 entries.
• Last-seen values — stored in a hidden sheet named _lastSeen inside your spreadsheet. Contains a snapshot of the last-synced property values per Notion page, used to detect which fields changed on each side since the last pass (conflict detection). This data mirrors what is already in your spreadsheet and stays within your own Google account.
• First-sync completion marker — a flag stored in Document Properties, set once when the first sync completes. Prevents re-sending the first-sync event on subsequent passes.

Data sent to Notion

When the add-on syncs, it calls api.notion.com using your OAuth token. These calls include:

• Queries for pages changed since the last pass (Notion → Sheets direction).
• Property updates for rows you have edited in Sheets (Sheets → Notion direction).
• Page creation or archival when rows are added or deleted in Sheets.

Notion's own Privacy Policy governs data transmitted to their API.

Data sent to Four Ducks servers

Two features transmit a small amount of data to servers operated by Four Ducks. No cell values and no Notion page content are ever included.

Activation events (automatic, no PII)

When certain milestones are reached, the add-on sends a minimal event to a Four Ducks endpoint. Each event payload contains only:

• Event type — one of: sidebar_opened, notion_connected, database_linked, first_sync_completed.
• Add-on version — a version string (e.g. 1.0.0).

No user identity, no Google account identifier, no spreadsheet content, and no Notion data are included. This feature is used to measure adoption milestones. It cannot be individually disabled, but it contains no information that can identify you.

In-product feedback (user-initiated)

When you click Send feedback in the sidebar and submit a message, the following is sent:

• Your typed feedback message.
• Add-on version.

If you check Include diagnostic context (checked by default), the following is also included:

• Column names and Notion property types — the names of the columns in your linked sheet and each column's Notion property type (e.g. text, number, select). Property values are not included.
• Last 5 sync log entries — timestamp, sync direction, rows changed, conflict count, skip count, and any error notes. No cell values are included.

Uncheck Include diagnostic context before submitting to exclude the additional diagnostic information.

Google API scopes used

The add-on requests the following Google OAuth scopes:

Scope	Why	Tier
spreadsheets.currentonly	Read and write rows in the active spreadsheet for sync; create hidden helper sheets (_syncLog, _lastSeen)	Non-sensitive
script.container.ui	Show the add-on sidebar and Extensions menu items	Sensitive
script.external_request	Call the Notion API and Four Ducks feedback/activation endpoints via UrlFetchApp	Sensitive
script.scriptapp	Create and delete the scheduled sync trigger and the installable onEdit/onChange triggers	Sensitive

No restricted Google OAuth scopes are requested — no Gmail, Drive, Contacts, Calendar, or Admin SDK access. The add-on only ever touches the spreadsheet it is installed in.

Sharing, transfer, and disclosure of Google user data

This section states, explicitly, with whom Google user data obtained through Google Workspace APIs is shared, transferred, or disclosed. "Google user data" here means the spreadsheet content the add-on reads or writes under the spreadsheets.currentonly scope, plus your Google account's authorization state.

Recipient	Google user data shared	Purpose
Notion Labs, Inc. (api.notion.com)	Cell values from the rows and columns of the sheet you explicitly linked, sent as Notion page property updates in the Sheets → Notion direction, together with the column names of that sheet. Only the linked sheet is read; no other tab, spreadsheet, or file is ever accessed.	To perform the sync you requested — the core function of the add-on. Transfer happens only after you connect your Notion account and link a specific sheet, and only for that sheet. Governed by Notion's Privacy Policy.
Gumroad, Inc.	None. Only the license key you type in is sent. No spreadsheet content, no Google account identifier, no email address.	Subscription validation.
Four Ducks (the publisher)	No cell values and no Google account identifiers. Activation events carry only an event name and add-on version. If you choose to attach diagnostic context to a feedback message, that context includes your linked sheet's column names and Notion property types and the last 5 sync log entries — never cell values.	Product analytics and support, both described in the sections above.

Beyond the recipients listed above, Four Ducks does not share, transfer, sell, rent, trade, or otherwise disclose Google user data to any third party. Specifically:

• No sale or advertising. Google user data is never sold, and never used for advertising, retargeting, or building advertising profiles.
• No data brokers, resellers, or affiliates. There are none.
• No subprocessors or hosting providers holding your content. The add-on runs entirely inside Google Apps Script on your Google account. Four Ducks operates no server that receives, stores, or processes your spreadsheet content.
• No human access. No employee or contractor of Four Ducks can read your spreadsheet content, your Notion content, or your OAuth tokens.
• Legal disclosure. Four Ducks holds no Google user data and therefore has nothing to produce in response to a subpoena, court order, or other legal process. Should that ever change, this policy will be updated before any such data is collected.
• Business transfers. If Four Ducks is acquired or merged, no Google user data would transfer, because none is held.

AI and machine-learning model training

Google user data obtained through Google Workspace APIs is not used to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. It is not transferred to any third party for that purpose, and no such model is used to process it. The add-on performs deterministic field-by-field synchronization only; it contains no AI or ML component.

Third-party services

• Notion (api.notion.com) — all sync operations. Notion's Privacy Policy applies.
• Gumroad — license key validation. When you enter a license key, it is sent to Gumroad's validation API to confirm your subscription is active. Gumroad's own privacy policy governs that transaction. The validation result is cached in your User Properties for one hour to limit API calls.

How we protect your Notion token

• Encryption in transit. All API calls are made over HTTPS/TLS. The token is never placed in a URL query string.
• Encryption at rest. The token is stored in Apps Script User Properties, which Google encrypts at rest on Google-managed infrastructure.
• Access control. User Properties are scoped to the individual Google account that authorized the add-on. No other user, and no employee or contractor of Four Ducks, can access your token — there is no backend that holds it.
• No logging of secrets. The token is never written to error logs or Stackdriver traces.
• No transfer to Four Ducks. The token is sent only to Notion's API, never to Four Ducks infrastructure.

Data retention and deletion

To stop syncing and remove stored data:

• Click Unlink in the sidebar to remove the link state for a sheet (sheet rows are left intact).
• Click Disconnect Notion to delete your Notion OAuth token from User Properties.
• Uninstall the add-on via Google Workspace settings to clear all Document Properties (link state, sync log, last-seen values, first-sync marker) tied to the spreadsheet.

Four Ducks retains no data on its own servers because the add-on holds none there. Feedback messages submitted via the in-product form are retained only as long as needed to address the support request, then deleted.

Children's privacy

This add-on is not directed at children under 13. We do not knowingly collect data from children.

Changes to this policy

We will update this page if we change how data is handled. Material changes will be noted with an updated effective date. Because we hold no contact details for users, we cannot notify you by email; the updated date on this page is the notice.

Contact

Questions or requests: support@fourducks.dev