Fillmore privacy policy

Effective date: 1 November 2026

Fillmore is an add-on for Google Sheets. It turns each row of a sheet into a Doc, Slides file or PDF. It can also email each file. This page says what Fillmore reads, what it keeps, and how to delete it.

The short version

Your rows, names and files stay in your Google account.
Fillmore has no database of your sheet data. It never copies your rows to our servers.
Our server will get only error codes, run ids and row numbers (not turned on yet). It never gets cell values.
Fillmore does not ask Google for your email address.
We do not show ads. We do not sell data. We do not use your data to train AI.

What Fillmore reads in your Google account

Fillmore asks Google for six permissions. Google shows them to you before you install.

What Fillmore reads or does	Permission (scope)	Why
The sheet you have open, and only that sheet	`spreadsheets.currentonly`	To read your rows and write each row's status back
Only files and folders you pick, and files Fillmore makes	`drive.file`	To copy your template, make each file, save PDFs, and undo a run
Shows the Fillmore sidebar and the file picker	`script.container.ui`	So you can set up and run a merge inside Sheets
Runs a merge again later, by itself	`script.scriptapp`	To finish long runs, and to make a file for each new form answer, when you turn this on
Sends email as you	`script.send_mail`	To email each file to the address in its row, when you turn this on. Also to ask Google how many emails you can still send today
Connects to web services	`script.external_request`	To call Google's Docs, Slides and Drive services

Fillmore cannot see your other sheets. It cannot see Drive files you did not pick. It cannot read your inbox.

Your email address

Fillmore does not ask Google for your email address. It does not read it, and it does not send it to our server.

To pick the right daily limits, Fillmore asks Google one number: how many emails you can still send today. A Google Workspace account can send more than a free Gmail account. So a high number means Workspace. Fillmore keeps only "Workspace" in your Google account, not the number and not your address.

Paid plans may need your email address later. Before that, we will update this page. Google will then ask you for the new permission.

What stays in your Google account

Everything Fillmore makes or saves stays in your Google account:

The files it makes, in the Drive folder you pick.
The status of each row, in your sheet.
The Run Log tab, in your sheet.
Your merge settings, stored by Google with your sheet ("document properties").
Your picked files and a daily count, stored by Google for your account ("user properties").
A short label on each file Fillmore makes. It holds a job id, a run id and a row key. It also holds a fingerprint (hash) of the row. This lets Fillmore skip rows it already made, and undo a run.

Fillmore's makers cannot open any of this. It is in your account, not ours.

What our server receives

Fillmore has one small server. It runs on Cloudflare Workers. It stores data in Cloudflare D1, a database.

Error reports. When something fails, Fillmore may send a report. A report has exactly three things:

an error code, such as TEMPLATE_MISSING
a run id, a random id for one merge run
a row number, such as 14

The server rejects any report with other fields. It never gets names, emails or cell values. A report cannot tell us who you are.

Licence check (not yet turned on). When paid plans start, Fillmore may ask our server for your plan. Then it would send your email address. Google will ask you for that permission first. For paying users, the server stores the email, the plan and the renewal date. Free users have no row in this table.

Status today. The beta does not yet send error reports or licence checks. We will update this page before either is turned on.

Payments (not yet turned on)

Paid plans will use Stripe for card payments. Stripe gets your card details, not us. Stripe then tells our server your email, plan and renewal date. Stripe has its own privacy policy.

How long we keep it

Data	Where	How long
Error reports (code, run id, row)	Cloudflare D1	90 days, then deleted.
Licence (email, plan, renewal)	Cloudflare D1	While your plan is active, then 12 months.
Server request logs	Cloudflare Workers Logs	Up to 3 days on Cloudflare's free plan, 7 days on the paid plan
Database backups	Cloudflare D1 "Time Travel"	Up to 7 days on the free plan, 30 days on the paid plan
Error logs from the add-on itself	Google Cloud Logging	30 days (Google's default)
Everything in your Google account	Your Google account	Until you delete it

Notes on the table:

Server request logs record each request to our server. A licence check may show your email there.
Deleted rows stay in backups until those backups expire.
Google keeps add-on error logs in Fillmore's Google Cloud project. Fillmore writes codes and ids there, not your data.

Sources, read Oct 16, 2026: Workers Logs limits, D1 Time Travel, Cloud Logging retention.

How to delete your data

Stop Fillmore. In Sheets, open Extensions, then Add-ons, then Manage add-ons. Remove Fillmore.
Remove its access. Open your Google Account connections page. Find Fillmore and remove its access.
Delete files and logs. Delete the files Fillmore made, like any Drive file. Delete the Run Log tab and status column in your sheet.
Delete server data. Email zaid.dev.work@gmail.com. We delete your licence row within 30 days.

Error reports have no name or email. So we cannot find "your" reports by name. Send us a run id and we will delete its reports.

What we never do

We do not show ads.
We do not sell or rent your data.
We do not share your data. The only exceptions are running Fillmore and obeying the law.
We do not use your data to train AI or machine learning models.
Our team does not read your files or sheets. You may share a file with us for support. We only read it with your clear permission.

Google API Services User Data Policy

Fillmore follows the Google API Services User Data Policy. This includes its Limited Use requirements.

Our statement:

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

In practice, this means:

We use Google data only to give you Fillmore's features.
We transfer it only to run those features, for security, or for the law.
People do not read it, except with your permission, for security, or for the law.
We do not use it for ads, credit checks or AI training.

Children and schools

Fillmore is a tool for teachers, school staff and offices. It is not made for children. Children should not install or use Fillmore.

Teachers may merge student data, such as names and grades. That data stays in the teacher's Google account. Fillmore does not copy it to our server.

School admins choose which add-ons their users may install. A school can ask us questions before allowing Fillmore.

Fillmore makes no claim about US school laws such as FERPA or COPPA. It has no certification or audit for them. Schools should follow their own rules for student data.

Security

Data between Fillmore, Google and our server travels over HTTPS.
Our server accepts only the fields listed above.
Only Fillmore's maker can open the server's database.

This website

This website uses Cloudflare Web Analytics. Your browser loads a small script from Cloudflare. It counts page views and visits. It also measures how fast each page loads. It does not follow you to other websites.

Cloudflare says it uses no cookies. Cloudflare also says it does not collect visitors' personal data.

The add-on does not use Web Analytics. It sends nothing to it.

Changes to this policy

We will post any change on this page, with a new date. Fillmore may want to use your Google data in a new way. Then we will ask you first. Google's policy requires this too.

Contact

Fillmore

Questions or deletion requests: zaid.dev.work@gmail.com