← Notion Sync for Sheets

Privacy Policy — Notion Sync for Sheets

What this add-on does with your data

Notion Sync for Sheets keeps a Notion database and a Google Sheets tab in sync in both directions. To do that it reads and writes your Notion pages and your spreadsheet cells. This policy explains exactly what is stored where, and what (if anything) leaves your Google account.

Data stored in your Google account

The following is stored exclusively in Google's infrastructure within your own account, using Apps Script storage APIs. It never passes through Four Ducks servers.

• Notion OAuth access token — issued by Notion when you click "Connect Notion." Stored in User Properties (per-user, private to your Google account). Used to call the Notion API on your behalf.
• Notion workspace name — stored in User Properties alongside the token. Used only to display which workspace is connected.
• License key — if you have purchased a paid license, the key you enter is stored in User Properties. It is sent to Gumroad's API to validate your subscription (see "Third-party services" below).
• Link state per sheet — stored in Document Properties (tied to the specific spreadsheet). Contains: the linked Notion database ID and title, the names and Notion property types of each column (not the values), the last-sync timestamp, and a pagination resume cursor if a sync was interrupted. No Notion page content is here.
• Sync log — stored in a hidden sheet named _syncLog inside your spreadsheet. Each entry records: timestamp, sync direction (notion→sheets or sheets→notion), number of rows changed, number of conflicts, number of skips, and any error notes. No cell values or Notion page content are written to the sync log. The log auto-trims to 500 entries.
• Last-seen values — stored in a hidden sheet named _lastSeen inside your spreadsheet. Contains a snapshot of the last-synced property values per Notion page, used to detect which fields changed on each side since the last pass (conflict detection). This data mirrors what is already in your spreadsheet and stays within your own Google account.
• First-sync completion marker — a flag stored in Document Properties, set once when the first sync completes. Prevents re-sending the first-sync event on subsequent passes.

Data sent to Notion

When the add-on syncs, it calls api.notion.com using your OAuth token. These calls include:

• Queries for pages changed since the last pass (Notion → Sheets direction).
• Property updates for rows you have edited in Sheets (Sheets → Notion direction).
• Page creation or archival when rows are added or deleted in Sheets.

Notion's own Privacy Policy governs data transmitted to their API.

Data sent to Four Ducks servers

Two features transmit a small amount of data to servers operated by Four Ducks. No cell values and no Notion page content are ever included.

Activation events (automatic, no PII)

When certain milestones are reached, the add-on sends a minimal event to a Four Ducks endpoint. Each event payload contains only:

• Event type — one of: sidebar_opened, notion_connected, database_linked, first_sync_completed.
• Add-on version — a version string (e.g. 1.0.0).

No user identity, no Google account identifier, no spreadsheet content, and no Notion data are included. This feature is used to measure adoption milestones. It cannot be individually disabled, but it contains no information that can identify you.

In-product feedback (user-initiated)

When you click Send feedback in the sidebar and submit a message, the following is sent:

• Your typed feedback message.
• Add-on version.

If you check Include diagnostic context (checked by default), the following is also included:

• Column names and Notion property types — the names of the columns in your linked sheet and each column's Notion property type (e.g. text, number, select). Property values are not included.
• Last 5 sync log entries — timestamp, sync direction, rows changed, conflict count, skip count, and any error notes. No cell values are included.

Uncheck Include diagnostic context before submitting to exclude the additional diagnostic information.

Google API scopes used

The add-on requests the following Google OAuth scopes:

Scope	Why	Tier
spreadsheets.currentonly	Read and write rows in the active spreadsheet for sync; create hidden helper sheets (_syncLog, _lastSeen)	Non-sensitive
script.container.ui	Show the add-on sidebar and Extensions menu items	Sensitive
script.external_request	Call the Notion API and Four Ducks feedback/activation endpoints via UrlFetchApp	Sensitive
script.scriptapp	Create and delete the scheduled sync trigger and the installable onEdit/onChange triggers	Sensitive

No restricted Google OAuth scopes are requested — no Gmail, Drive, Contacts, Calendar, or Admin SDK access. The add-on only ever touches the spreadsheet it is installed in.

Third-party services

• Notion (api.notion.com) — all sync operations. Notion's Privacy Policy applies.
• Gumroad — license key validation. When you enter a license key, it is sent to Gumroad's validation API to confirm your subscription is active. Gumroad's own privacy policy governs that transaction. The validation result is cached in your User Properties for one hour to limit API calls.

How we protect your Notion token

• Encryption in transit. All API calls are made over HTTPS/TLS. The token is never placed in a URL query string.
• Encryption at rest. The token is stored in Apps Script User Properties, which Google encrypts at rest on Google-managed infrastructure.
• Access control. User Properties are scoped to the individual Google account that authorized the add-on. No other user, and no employee or contractor of Four Ducks, can access your token — there is no backend that holds it.
• No logging of secrets. The token is never written to error logs or Stackdriver traces.
• No transfer to Four Ducks. The token is sent only to Notion's API, never to Four Ducks infrastructure.

Data retention and deletion

To stop syncing and remove stored data:

• Click Unlink in the sidebar to remove the link state for a sheet (sheet rows are left intact).
• Click Disconnect Notion to delete your Notion OAuth token from User Properties.
• Uninstall the add-on via Google Workspace settings to clear all Document Properties (link state, sync log, last-seen values, first-sync marker) tied to the spreadsheet.

Four Ducks retains no data on its own servers because the add-on holds none there. Feedback messages submitted via the in-product form are retained only as long as needed to address the support request, then deleted.

Children's privacy

This add-on is not directed at children under 13. We do not knowingly collect data from children.

Changes to this policy

We will update this page if we change how data is handled. Material changes will be noted with an updated effective date. Because we hold no contact details for users, we cannot notify you by email; the updated date on this page is the notice.

Contact

Questions or requests: support@fourducks.dev