What the add-on reads, what it keeps, and what leaves Google.

When you install or first open the add-on, Google shows the permissions it requests. These are the only ones it has, and this is what each is used for:

• See and edit the form it is opened in (forms.currentonly): reading the form's questions and responses, and changing the options of the questions you choose to sync. It cannot open any other form.
• Read spreadsheets (spreadsheets.readonly): reading the spreadsheet you link to a question. The add-on only reads the tab you choose. It never writes to, creates or deletes a spreadsheet.
• Show a sidebar in Google Forms (script.container.ui): the add-on's sidebar and its Check setup box.
• Run when you are not present (script.scriptapp): installing the add-on's own triggers in your account, so it can sync after every response and, if you choose, every hour or once a day.
• Send email as you (script.send_mail): sending notification emails, from your account, to your own address only. It never emails anyone else.
• Connect to an external service (script.external_request): the licence check described in section 5. The add-on's settings allow outside connections to one address only, TELCOMA's licence server at api.formoptionssync.com. The add-on reads your spreadsheet through Google's own Sheets service, not through an outside server.
• See your email address (userinfo.email): to know which account's licence to check and where to send notification emails.

The add-on does not ask for access to Google Drive, Gmail, Calendar, Contacts or your organisation's directory, and so it cannot read them.

• Responses. To count seats, the add-on reads the answers to the questions you sync, and only those. It turns them into a number per option and keeps only the numbers. It does not keep respondents' names, email addresses or any other answers, and it never edits or deletes a response.
• The form. The questions' titles, types and options, section jumps and quiz answer keys, so it can update options without losing them.
• Your linked spreadsheet. The values in the tab you choose. It uses the options column, and the seats and filter columns if you set them.
• Your email address. For the licence check and for notification emails.

Everything below is stored inside Google, using Google Apps Script's storage. Nothing here is sent to us.

With the form (the form's "document properties"). Anyone who can edit the form and opens the add-on works with these same settings:

• Sync settings: for each synced question, its title and type; the spreadsheet's ID and title, tab name, column letters and filter value, or, for a question that keeps its own options, those option names and their seats; the order and seat-limit settings; the email address of the editor who last saved the sync; and a summary of the last sync (time, number of options, names of full or overbooked options, any warning or error). Also the form's "When to sync" and "Email me when" choices, and the email address of the account whose triggers run the automatic syncs.
• Response counts: a number per option name, per synced question. No names, email addresses or other answers. The add-on counts only answers that match one of the question's own options, so free-text "Other" answers are never stored.
• Counting bookmark: the time of the newest response counted, the total counted, when the last full recount ran, and the internal IDs of the responses from the last few seconds, so no response is counted twice.
• Last rows read from the sheet: option names and seat numbers only, with the time they were read. Used when Google Sheets cannot be reached.
• Section jumps and quiz keys per option: for options that jump to a section or are marked as a correct quiz answer, so they get them back when a full option reopens.
• Run log: the last 20 syncs, each with its time, what started it, whether it worked and a one-line summary, which can name questions and options.

With your Google account (the add-on's "user properties", visible only to the add-on when you use it):

• The IDs of the forms where you have set up syncs. The first one holds your free-plan slot.
• The last licence result: plan, expiry, your email address and when it was checked.
• When the last hourly or daily refresh ran and whether it found its form.

For a few minutes: after a response, the add-on keeps a copy of the linked tab's values in Google's script cache for up to 5 minutes, so a burst of responses reads the sheet once. Google deletes it after that.

To know whether you are on the free plan or Pro, the add-on sends your Google account's email address and the current time to TELCOMA's licence server, over HTTPS, signed with a secret key (HMAC) so the server can tell the request came from the add-on. The server answers with your plan and its expiry date, nothing else. The result is kept for up to 6 hours, so the check runs at most a few times a day, or when you click Already upgraded?.

The licence server is run by TELCOMA on servers hosted by Fly.io. It stores:

• For every email address that is checked: when it was last checked and how many times.
• For customers: the plan, its expiry, which payment provider it came from, and the time of that provider's latest update; and any plan we grant by hand, with a short internal note.
• The payment provider's notifications about your subscription. Their full content is deleted after 90 days. A short record (provider, event ID, event type, email address and time) is kept so the same notification is never applied twice.

No responses, form content or spreadsheet content ever leave Google. The licence check carries only your email address and the time.

• The licence server's records in section 5.
• Technical logs that Google gives add-on developers: when the add-on ran, whether it worked, and the text of any error. Error text can mention the name of an option, question or sheet tab it concerns. We use these logs only to find and fix faults.
• Whatever you send us in a support email.

We cannot open your form, your responses or your spreadsheets.

• We use the data only to run the add-on for you, check your plan and answer your support requests.
• We do not show advertising, and we do not use your data for advertising.
• We do not sell, rent or share your data with anyone, except the payment provider in section 6 and the hosting provider in section 5, which act for us.
• We do not use your data, or data from Google APIs, to train AI or machine-learning models.
• No person at TELCOMA reads your Google data. The add-on is built so that we cannot.

• Removing a sync deletes that question's response counts, its stored sheet rows and its section-jump memory. The run log keeps its entries until newer syncs push them out (it holds 20).
• Uninstalling the add-on and deleting the form removes everything stored with the form, because it is stored as part of the form. To stop the add-on's access to your account, remove it at myaccount.google.com/permissions.
• Licence records are kept while you use the add-on or have a plan, and for 12 months after that. We delete them sooner on request: email support@telcomaglobal.com from the Google account concerned, and we will delete them within 30 days. If you have a paid plan, the merchant of record keeps its own records of your purchase as the law requires.
• Notification emails are in your own mailbox. Support emails stay in our support mailbox.

You can also ask us for a copy of the licence records we hold about you, or to correct them, at the same address.

• Everything the add-on stores stays inside Google, under your account and your form.
• The licence check uses HTTPS and is signed. The server rejects unsigned requests and requests more than 10 minutes old. The secret key is kept in the add-on's developer settings, which users cannot see.
• Spreadsheets are read-only to the add-on. A sheet sync runs only from the account that set it up, so another editor cannot make your account read a sheet you did not choose.
• One sync runs at a time per form, so no response is counted twice.

Please report security issues to support@telcomaglobal.com and do not post them publicly.