Privacy policy
Last updated: 11 November 2026
TrustyMerge is a Google Workspace add-on and web app. It turns rows of a Google Sheet (or Google Form responses) into Google Docs, Slides and PDFs in your Google Drive, and can email each result for you. TrustyMerge is operated by ProjectHax LLC ("we", "us"). This policy explains what we access, what we keep, for how long, and how to delete it.
1. What TrustyMerge can access in your Google account
TrustyMerge asks for the narrowest Google permissions (OAuth scopes) that make it work:
| Permission | Why we need it |
|---|---|
openid and userinfo.email(your Google account id and email address) |
To sign you in, tie your jobs and plan to your account, recognise a School/Domain licence by your Workspace domain, and send you service emails about your account. |
drive.file("only the specific Google Drive files you use with this app") |
To read the sheet you open TrustyMerge in, copy the templates you pick, create documents, PDFs and folders in the folders you pick, and write the merge status and links back to your sheet. TrustyMerge cannot see any other file in your Drive. |
script.locale |
To show the side panel in your language. |
We do not request access to your whole Drive, your Gmail (neither reading nor sending), your contacts or your calendar.
Emails you ask TrustyMerge to send
If you turn on "Email each document" for a job, TrustyMerge sends each merged document to the address in that row. The email is sent by TrustyMerge on your behalf, through our email provider Resend: it arrives from "your name via TrustyMerge" at our own address, replies go to your Google account's email address, and a line at the end says who it was sent for. To deliver it, the recipients' addresses, the subject, your message and the attached document are passed to Resend, which processes them under its own privacy policy. We keep only the fact that the row's email was sent; we do not keep the recipients, the message or the attachment. Emailing is off unless you turn it on, job by job.
2. What we store and what we don't
We do not store
- The values in your sheet or form responses.
- The contents of your templates, merged documents or PDFs. Rows are processed in memory; PDFs pass through temporary memory and are discarded right after they are uploaded to your Drive.
- The emails we send for you (recipients, bodies and attachments as sent): they are handed to our email provider for delivery and not kept by us. Our logs contain ids and error codes only; where a log needs to refer to an email address, it holds a one-way hash instead of the address.
We store
- Your account: your Google account id, email address and Workspace domain (if any), your plan, and your Google authorization (refresh token), which is encrypted at rest.
- Your job settings: the ids of the sheet, templates and folders you chose, column names,
conditions, and the filename, folder and email templates you typed (for example
Certificate - <<Name>>). - Run history: for each processed row, its row number, a one-way fingerprint of the row (used to avoid merging the same row twice), the ids of the created files, the status and any error message.
- Usage counts: how many documents you merged each month, to apply plan limits.
- Plan records: your plan, the date it is paid until, and Stripe's reference numbers for the customer and the subscription. If you pay before connecting your Google account, a one-way hash of the email used at checkout is kept until you connect, so the purchase can be matched to you; the address itself is not stored.
The website uses one cookie: a sign-in session cookie for the job editor and settings pages, which expires after 12 hours. We don't use advertising or third-party analytics cookies.
3. How we use it
We use this data only to run the merges you set up, show you your job history, apply your plan, send you service emails (for example "TrustyMerge needs you to reconnect", an optional daily summary of failed rows that you can turn off, and the inactivity warning described below), answer your support requests, and keep the service secure and reliable.
- We do not sell your data or share it for advertising.
- We do not show ads.
- We do not use your data, including any data received from Google APIs, to develop, improve or train generalized or non-personalized AI or machine-learning models.
- People at ProjectHax LLC do not read your sheets or documents. We can only see the metadata listed above, and we look at it only to fix a problem you reported, for security, or when the law requires it.
4. Google API Services User Data Policy (Limited Use)
TrustyMerge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy. We use Google user data only to provide and improve the user-facing features described in this policy. We don't transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to you, and we never use it for advertising.
5. How long we keep it
| Data | Kept for |
|---|---|
| Per-row run history (row numbers, file ids, status, errors) | 90 days. A row's record is kept longer only if its status could not yet be written back to your sheet, because otherwise the row would be merged again. |
| Run summaries (counts per run) | 1 year |
| Your account, job settings and usage counts | Until you delete them, or until the account is deleted for inactivity (below) |
| Backups of our database | 14 days (nightly backups, the oldest is overwritten) |
6. Deleting your data
Delete it yourself, any time
- Settings → Delete my data revokes TrustyMerge's access at Google and immediately erases your account, jobs and run history from our database. Copies in our backups are gone within 14 days. Two counts stay for a short time, under a one-way hash of your Google account id and with nothing else attached, so that the plan's limits cannot be reset by deleting and signing up again: the number of documents used this month (removed when the month ends) and the number of emails sent in the last 24 hours (removed after a day).
- Settings → Disconnect revokes TrustyMerge's access at Google and pauses your jobs without deleting your settings.
- You can also remove TrustyMerge's access from your Google Account at myaccount.google.com/permissions. Your jobs then pause until you reconnect.
- Or email [email protected] from your account's email address and we'll delete it for you.
Inactive accounts are deleted after 18 months
If an account has no sign-in and no merges for 18 months, we delete it. Before that:
- We send an email warning to your Google account's email address 30 days before the deletion, with the deletion date. The account is never deleted sooner than 30 days after that email.
- Signing in keeps the account: opening TrustyMerge or signing in to the job editor cancels the deletion. So does any merge your jobs run.
- Accounts with an active paid licence are kept.
The deletion works exactly like "Delete my data": we revoke TrustyMerge's access at Google and erase your account, jobs and history.
Files in your Drive are never deleted. Deleting your TrustyMerge data, by yourself or for inactivity, never removes your sheets, templates, merged documents or PDFs. They stay in your Google Drive, and the status columns stay in your sheet.
7. Service providers
We use these companies to run TrustyMerge. They process data only on our behalf:
| Provider | What for | Data involved |
|---|---|---|
| The Google APIs TrustyMerge works through | Your files, under your authorization | |
| RamNode | Hosting our servers and database (United States) | Everything listed in section 2 |
| Cloudflare | DNS, HTTPS and protection for our website and app; routing of support email; storage of our nightly database backups | Network traffic, support emails; the backups, which are encrypted before they leave our server with a key Cloudflare does not have |
| Stripe | Payments for paid plans | Your name, email and payment details (we never see your card number) |
| Resend | Sending our service emails to you, and the emails you ask a job to send | Your email address and the email's text; for a job's emails also the recipients' addresses, the subject, your message and the attached document |
When you buy a paid plan, Stripe tells our server that the payment succeeded, which plan it was for, and when it renews or ends. That is how your purchase is linked to your TrustyMerge account. We do not receive your card details.
8. Security
All traffic uses HTTPS. Google authorizations are encrypted at rest with a key kept outside the database. Our website and app are served through Cloudflare. Access to production systems is limited to the people who run the service.
9. Schools and Workspace domains
When a school or organisation uses TrustyMerge, it processes its users' data on the organisation's instructions and only for the purposes in this policy. Workspace administrators can remove TrustyMerge for their whole domain at any time from the Google Admin console. TrustyMerge is a tool for the people who manage the sheets; it is not directed at children, and student information in your sheets is never stored by us (see section 2).
10. Your choices and rights
You can see and change your jobs and their history in the job editor, and delete everything as described above. Depending on where you live (for example under the GDPR or US state privacy laws), you may have the right to access, correct, delete or port your personal data, or to object to its processing. Email us and we'll respond within 30 days. You can also complain to your local data-protection authority.
11. Changes
If we change this policy in a way that affects how we use your data, we'll update the date above and tell active users by email before the change takes effect. We will not use data already collected in a new way without your consent.
12. Contact
ProjectHax LLC, Pennsylvania, United States
Email: [email protected]