With one exception — the licence record described below — everything the add-on saves is held by Google, inside your own account, using Apps Script's Properties Service:
- Document properties — the index of sections in that document; the History of sections you have deleted from it (including their text and formatting so they can be restored); any custom tag types you have defined for that document and which tag each section carries; and whether automatic numbering is on and how deep it goes. All of this is stored with the document itself, which is why a colleague who opens the same file sees the same tags.
- User properties — your own preferences and your own content: whether the sidebar opens automatically, dark mode, any custom heading and button colours, compact view, sort order, your chosen History depth, which sections you have collapsed, whether you have seen the latest update note and whether you have completed the guided tour; plus your saved section templates, which is why they are available to you in every document and are not visible to anyone else who opens the same file.
None of this reaches us. Deleting the document deletes its stored sections, tags and History along with it; uninstalling the add-on revokes its access.
Licence checks — the one thing that does leave your account
If you buy Pro, the add-on talks to our licence server so it knows whether your key is valid. This happens when you activate a key, and again each time the sidebar opens. Each request contains:
- The licence key you were issued.
- An installation identifier — a random value the add-on generates for itself the first time it needs one. It is not derived from your name, your email or your Google account, and it tells us only that two requests came from the same installation. It is what stops one key being shared across unlimited accounts.
- An optional label — whatever you type into the "your name or email" box when activating. It is never verified, never required, and exists only so you or whoever manages your team's seats can tell one seat from another later. If you type an email address here, we hold that email address.
On a Pro licence covering more than one seat, the same record is what lets whoever manages the licence see which seats are in use, under the labels their holders typed, and release a seat when someone leaves.
Organisation settings — the other thing we hold
Pro licences can define settings once and have every seat inherit them: the organisation's tag types and the defaults new documents start from. Because those have to reach seats that have never met each other, they are stored on our licence server against your licence rather than in any one document.
They contain what an administrator typed into the settings panel — tag names and preference values. They do not contain document content, document names, heading text, or any list of which documents your organisation has. If you never buy Pro, none of this exists for you.
No document content, document name, heading text or Google account identifier is included in these requests. If the licence server cannot be reached, the add-on carries on with whatever status it already had rather than locking you out.