Privacy policy

Last updated: October 4, 2026

This policy covers the Audeza Choice Sync add-on for Google Forms and the website audeza.com. Audeza is a product of Carlos Brotas, trading as Rovugui Studio, R. Hermano Neves 18, 1600-477 Lisboa, Portugal. "We" means Rovugui Studio. Contact: support@audeza.com.

What the add-on accesses

The form you open the add-on in (forms.currentonly). It reads question titles and types, writes choices to the questions you link, and reads responses only to count how often each choice was picked when you turn on limited slots.
Spreadsheets you pick with the Google file picker (drive.file). It reads the tab and column you choose. It can't see any other file in your Drive.
Your email address (userinfo.email), to send you failure alerts and to check whether you have a paid plan.
Connecting to external services (script.external_request), only to call the Google Sheets API, and audeza.com for the license check and sync-failure alerts.
Running in the background (script.scriptapp) and showing the sidebar (script.container.ui).

What we store and where

In your form's add-on storage at Google: your link settings (spreadsheet id and name, tab, column, header text, limit options) and the last 60 run log entries, including question titles and error messages. This data stays in your Google account and is deleted when you remove the links or the add-on.
On our server: when you open the sidebar or a sync runs, the add-on sends a short-lived Google access token to audeza.com. The server asks Google which email address the token belongs to, then looks up your plan. The server keeps the token in memory for up to 10 minutes so it doesn't ask Google again on every request. It never writes the token to disk, to a database or to logs. We store purchase records sent by our payment provider: email address, plan, subscription status and dates.
When a sync fails: the add-on sends the form title, the form's link, the question title, the spreadsheet and tab name, and the error message to audeza.com, which emails them to you through Resend. The only recipient is the address your Google token belongs to. We keep a record of the alert (your email address and those details) for 24 hours, so we send at most one email per question and error per day, then delete it.

We never copy your sheet's values or your form responses to our servers.

How we protect data

Your sheet and form data stay at Google. The add-on runs on Google's servers. It reads your sheet through the Google Sheets API and writes choices to your form directly, so sheet values and form responses never pass through our servers.
Narrowest scopes. The add-on asks for drive.file instead of access to your whole Drive, and forms.currentonly instead of access to all your forms. It can open only the spreadsheets you pick and the form you're working in.
Encryption in transit. Every connection is encrypted with TLS: between the add-on and Google APIs, between the add-on and audeza.com, and between our server and the services it calls (Google, Resend and our Umami analytics server). audeza.com accepts HTTPS only and sends HSTS headers.
Verified identity. Our server never trusts an email address sent by the add-on. It asks Google which verified address an access token belongs to, and sends alerts only to that address.
Verified payments. Purchase records change only when a webhook from Polar carries a valid signature. Other requests are rejected.
Restricted access. Only the operator of Rovugui Studio can reach the server and its database. Secret keys (payment webhook secret, email API key) live in the server's environment settings, never in the add-on's code or the website. The add-on contains one key, for the Google file picker, which Google designs to be public and which is restricted to the Picker API.
Short retention. Alert records are deleted after 24 hours and access logs after 30 days. Purchase records are the only long-lived data we hold.
Breach response. If a breach affects your personal data, we'll tell you and the Portuguese data protection authority (CNPD) within 72 hours of learning about it, as the GDPR requires.

Payments

Polar (polar.sh) processes payments as merchant of record. They collect your billing details under their own privacy policy. We receive the email address, plan and subscription status.

Google user data

Audeza Choice Sync's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell user data, use it for advertising, or use it to train AI models. People at Audeza don't read your Google data, except when you ask us for help and give us permission, when security or the law requires it, or for data that's aggregated and anonymized.

We share data only with the services needed to run the product: Google (the add-on platform), Polar (payments), Resend (sends the failure alert emails) and our hosting provider. We disclose data when the law requires it.

Retention and deletion

Purchase records are kept as long as tax law requires. To delete everything else we hold about you, email support@audeza.com. To revoke the add-on's access, remove it in Google Forms or at myaccount.google.com/permissions.

Website

audeza.com sets no cookies. We measure visits with Umami, an open-source analytics tool that we run ourselves at analytics.rovugui.com, so the data isn't shared with an analytics company. It records the pages you view, the buttons you click (for example Install or a plan), your referrer, and your browser, device type and country. It doesn't use cookies, doesn't store your IP address, and can't identify you. When you start a checkout from the add-on or buy a plan, our server records the plan, never your email.

Our server also keeps standard access logs (IP address, time, page) for up to 30 days for security.

Children

The add-on is meant for adults at work. We don't knowingly collect data from children.

Changes

We'll post changes here and update the date at the top. If a change affects how we use Google data, we'll ask for your consent again where required.