How this application handles Google data
Last updated: 6 November 2026.
1. Information accessed
After the owner authorises the Google OAuth permission https://www.googleapis.com/auth/script.projects.readonly, the private service can access the designated Apps Script project's file inventory and source needed for approved verification. The current verification process checks content fingerprints for 15 permitted public-source files and checks the names/types of three separately protected Google-only files. The three protected file bodies are not included in the owner-facing result.
Authentication may involve owner identity and session information through GitHub and Supabase. The service also processes OAuth grant details and security audit metadata needed to validate access.
2. Purpose of processing
Google data is used only to check approved project identity, public-source integrity, protected-file identities, and the status of an authorised read. The application does not request permission to modify Google Apps Script projects and does not sell Google user data or use it for advertising.
3. Storage and access safeguards
The private service uses managed authentication, server-side access checks and restricted credential storage (including Supabase Vault). Audit evidence may include execution identifiers, timestamps, operation mode and verification counts. Source-file contents are not returned to the browser in the verification status response. The public website itself does not collect Google authorisation credentials.
4. Service providers and disclosure
Services used for authentication, hosting and secured application processing include Google, GitHub, Cloudflare and Supabase. These providers process information necessary to deliver their respective services under their own terms and policies. Google user data is not intentionally disclosed to other users or used for marketing. Data may be disclosed if legally required.
5. Retention and deletion
Operational audit and grant metadata are retained according to the application's security and operational needs. The owner can withdraw Google access through their Google Account permissions. Revocation stops further use of that grant, although existing operational records may require separate deletion. Requests about record deletion or access should be directed to the application's developer using the support contact displayed on the Google OAuth consent screen.
6. Security and accuracy
Access is restricted to approved owner sessions; Google source access is confined to the specified project and read-only permission. No internet service can guarantee absolute security. If the application's operation or data practices change, this notice should be updated before requesting additional Google permissions.
7. Contact
This private application's developer can be contacted via the user-support email shown on its Google OAuth consent screen. The public support contact should be confirmed by the owner before this page is submitted for Google verification.