Who operates this
The add-on is published by the operator of maste.ro, contact
[email protected]. The operator's full legal name and
postal address are shown on the Google Workspace Marketplace listing, as required for traders
under the Digital Services Act.
What the add-on can access
| Scope | What it allows | What it does not allow |
|---|---|---|
| documents.currentonly | Reading and editing the single Google Document that is open while the sidebar is open. | Listing your Drive, opening any other document, reading Gmail, Calendar or Contacts. These are not requested and cannot be used. |
| drive.file | Reading and editing only the documents you choose in the Google file picker, when you use Other documents → Add documents… to search several documents in one run. | Listing or searching your Drive, or opening any file you have not picked. The add-on never sees the rest of your Drive. |
| script.container.ui | Drawing the add-on's own sidebar inside the document window. This is what Google requires of any add-on that has a panel at all. | Reading or changing anything. It grants no access to data of any kind. |
Your document's text is processed inside Google's own infrastructure (Google Apps Script) and in your browser. It is never transmitted to us, never logged, never stored on our side, and never used to train anything.
Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What is stored, and where
Inside your document
The undo journal — the list of what was replaced during the last run, so the run can be reversed. It lives in the document's own add-on properties, not on our servers. When a run also covered documents you picked, their part of the journal is kept here too, in the document the run started from. It is overwritten by the next run and you can clear it from the sidebar.
Inside your Google account, for the add-on
Your last-used search options, and — for paying users — the licence key you pasted in. Stored in Apps Script user properties, which only this add-on can read.
On the payment processor's side
If you buy a licence, the purchase is handled by Paddle.com Market Ltd, which is the merchant of record and the controller for that transaction. We never see or handle your card details. Paddle emails you a licence key, and you paste it into the add-on once. The key is checked inside the document itself, by arithmetic, with no network request: the add-on never contacts our servers or anyone else's, and your email address never leaves Google. The key is kept in your own Google account's add-on storage, where only you can read it.
Paddle's privacy policy: paddle.com/legal/privacy
Support email
If you write to us, we keep the message and your address for as long as needed to resolve the matter and to recognise a follow-up, then delete it. We do not add you to any mailing list.
How your data is protected
The add-on's access to your document is sensitive data, and it is protected as follows.
- No copy leaves Google. Document text is read and changed only inside Google Apps Script and your browser. The add-on makes no outbound network requests (it has no permission to do so), so there is no server, database or backup of ours where your content could be exposed.
- Encryption in transit. All traffic between your browser, the sidebar and Google Apps Script uses HTTPS (TLS), provided by Google. Our website and support email also use TLS only.
- Encryption at rest. The undo journal, your saved options and the licence key are kept in Google's document and user property storage, which Google encrypts at rest.
- Access control. Document properties are readable only by this add-on, in documents
the user has opened it in; user properties only by this add-on, for that one user. The OAuth
scopes are the narrowest available (
documents.currentonlyanddrive.file), so the add-on cannot reach any file you did not open or pick. Nobody on our side can read your documents or stored properties. - Minimisation and retention. Only what a feature needs is stored: the undo journal holds the last run only and is overwritten by the next run or cleared by Undo last run. Once you uninstall, nothing can read or change it: it stays in the document's add-on storage, which only this add-on can open, until the document itself is deleted.
- Our own accounts. Only the operator can reach the Google Cloud project, the publishing account and the support mailbox, and each is protected by its own strong password. The Google account behind the project also uses two-step verification, which Google Cloud requires. Support emails are deleted once the matter is resolved.
- Incidents. If we ever learned of a breach affecting your data, we would notify affected users and the competent supervisory authority within 72 hours, as the GDPR requires.
What we never do
We do not sell or share personal data. We do not use analytics, trackers or advertising identifiers in the add-on. We do not read documents you have not opened or picked, and we could not do so even if we wanted to, because the permission does not exist.
Your rights
Under the GDPR you can ask what we hold about you, correct it, have it deleted, or object to its processing. Write to [email protected]; we answer within 30 days, usually within 48 hours. For purchase records, requests can also go directly to Paddle.
To stop everything at once: uninstall the add-on from the Google Workspace Marketplace. That revokes its access immediately, and from then on nothing it stored can be read by anyone, us included. Google does not delete add-on storage on uninstall: the undo journal stays, unreadable, inside each document until the document is deleted, and your options and licence key stay in your account's add-on storage. Press Undo last run before uninstalling if you want the journal cleared from a document.
Changes
If this policy changes in a way that affects what is collected, the date at the top changes and
the previous version is described here. 16 September 2026: added the section “How your data is protected”; nothing collected changed. 19 September 2026: documents picked in the file picker (drive.file); what uninstalling does is described exactly.