Legal

Privacy Policy

HomeDrop Inc. — Google Workspace Add-ons

Last updated: May 2026

Welcome to HomeDrop. We are committed to protecting your privacy and being transparent about how our products work. This Privacy Policy explains how HomeDrop Inc. ("we", "us", or "our") collects, handles, and protects information in connection with our Google Workspace add-ons and associated services (collectively, the "Services").

This policy applies to all HomeDrop add-ons, including but not limited to Save Gmail Attachments, HomeDrop, and any other add-ons or tools we publish under the HomeDrop brand. Different add-ons request different Google permissions depending on their function. Each add-on requests only the permissions necessary for its specific features, as presented to you on the Google OAuth consent screen at the time of installation.

1. Information We Collect

a. Subscription information

The only personal information we collect and store on our own infrastructure is your email address, collected when you subscribe and used to validate your license and send transactional emails; your subscription plan and status, stored to determine your access level; and your license key, a randomly generated activation code linked to your email address. This data is stored in Supabase, a secure cloud database. We do not collect your name, postal address, phone number, or any other personal identifiers beyond your email.

b. Google account data accessed by our add-ons

To perform their core functions, our add-ons may access the following data within your Google account, depending on which add-on you have installed:

Gmail messages, labels, and attachments — read to identify emails matching your configured rules. Processed in memory and never transmitted to or stored on our servers.

Google Drive — used to create folders and save files to locations you specify. All files remain in your Drive under your control at all times.

Google Sheets — used to read or write data to spreadsheets you designate. Data flows directly within your Google account.

Google Docs — used to read or write content within documents you designate. Document content is never transmitted to or stored on our servers.

Your Google account email address — used for license validation and to associate your subscription with your account.

In all cases, Google account data is processed in memory during execution and routed directly between Google services. Your content — emails, files, documents, spreadsheet data — never touches our infrastructure.

c. Error and performance logs

We collect application error logs via Google Cloud Logging to monitor system performance and diagnose technical issues. These logs do not contain email content, file contents, document content, or personally identifying information beyond your Google account identifier.

d. Payment information

Payment processing is handled entirely by Stripe. We do not collect, see, or store your payment card details. Stripe provides us only with subscription status information.

2. How We Use Your Information

a. To provide and operate the Services

We use your email address to validate your subscription. Your Google account data is accessed solely to perform the functions of the add-on you have installed and configured. We do not use this data for any other purpose.

b. Transactional communications

We use your email address to send your activation code upon subscribing, payment receipts and renewal confirmations, payment failure notifications with retry instructions, and material updates to these policies with at least 30 days notice. We do not send marketing emails. You will only receive emails directly related to your subscription and account.

c. Service improvement

Aggregated, anonymised error logs are used to identify and fix bugs. No personal data or Google account data is used for analytics, product improvement, or any machine learning purposes.

3. What We Do Not Do

We do not store your emails, email content, or email attachments on our servers. We do not store your Drive files or their contents on our servers. We do not store your Sheets data or Docs content on our servers. We do not sell your personal information to any third party. We do not use your data for advertising or targeted marketing. We do not use your data to train AI or machine learning models. We do not share your Google account data with third parties except as necessary to operate the service. We do not access your Google account data except when an add-on is actively executing a function you configured.

All processing of Google Workspace data occurs in memory during execution and flows directly between Google services. Your content never passes through our servers.

4. Sharing Your Information

We do not sell your personal information. We share information only in the following limited circumstances.

a. Service providers

Supabase stores your email, license key, and subscription status on secure, encrypted cloud infrastructure. Stripe processes subscription payments and manages billing, and receives your email address for invoicing and payment communications. Google Cloud hosts our add-on infrastructure and error logging.

b. Legal requirements

We may disclose your information if required by law or if we reasonably believe such action is necessary to comply with a legal obligation or government request, protect and defend our rights or property, prevent fraud or security issues, or protect the safety of our users or the public.

c. Business transfers

In the event of a merger, acquisition, or sale of assets, your subscription information may be transferred. We will notify you by email and post a notice on our website before your information becomes subject to a different privacy policy.

5. Google OAuth and Permissions

We use the Google OAuth 2.0 protocol for authentication and authorization. You never share your Google password with us. You are shown a clear consent screen listing exactly which permissions each add-on requests before granting access. You can revoke access to any of our add-ons at any time at myaccount.google.com/permissions.

Permissions our add-ons may request, depending on the product:

Read Gmail messages and labels — used by Save Gmail Attachments to find emails matching your rules and extract attachments.

Access Google Drive — used by Save Gmail Attachments and other add-ons to create folders and save files to your Drive.

Access Google Sheets — used by add-ons that read column headers or write data to spreadsheets you specify.

Access Google Docs — used by Docs-based add-ons to read or write content within documents you designate.

View your Google account email address — used by all add-ons to validate your subscription and link your license to your account.

Connect to external services — used by all add-ons to validate your subscription status with our licensing server.

Run on a schedule — used by add-ons with background sync to execute your configured rules automatically.

Each add-on requests only the permissions it requires. Our use of data obtained through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Data accessed through Google APIs is used only to provide and improve the features of the relevant add-on that are visible to you, and is not transferred to third parties or used for any purpose unrelated to that add-on's function.

6. Data Retention and Deletion

Your email address and subscription record are retained while your subscription is active and for up to 12 months after cancellation for financial record-keeping. Error logs are automatically deleted after 30 days. Google Workspace data including Gmail, Drive, Sheets, and Docs content is never stored and is processed in memory only.

To request deletion, email us at support@homedrop.io with the subject "Data deletion request" and your billing email address. We will permanently delete your email address and all associated subscription records from our systems within 30 days of your request. Data already written to your Google Drive, Sheets, or Docs by our add-ons remains in your Google account — you control that data directly through Google.

7. Data Security

All data transmitted between our add-ons and our services uses HTTPS/TLS encryption. Supabase database access is protected by Row Level Security policies and API key authentication. Stripe handles all payment data under PCI-DSS compliance. Google OAuth 2.0 ensures your Google credentials are never exposed to us. Access to subscription data is restricted to authorised personnel only.

No method of electronic transmission or storage is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security.

8. Your Rights and Choices

Depending on your location, you may have the right to request access to the personal information we hold about you, request correction of inaccurate information, request deletion of your personal information, request your data in a portable format, object to certain processing of your information, or revoke Google account access at any time via myaccount.google.com/permissions. To exercise any of these rights, contact us at support@homedrop.io. We will respond within 5 business days.

9. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where reasonably practicable, by sending an email to your billing address at least 30 days before the changes take effect.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

HomeDrop Inc.

support@homedrop.io

We will respond to all inquiries within 5 business days.