QR
QR Attendance - ConvertSharp

Privacy Policy - QR Code Attendance Tracking By ConvertSharp

Effective Date: October 19, 2026

This Privacy Policy describes how the "QR Code Attendance Tracking By ConvertSharp" Google Workspace™ Add-on (referred to as "QR Attendance Tracker", "the Add-on", or "we"), developed and operated by convertsharp.com, collects, processes, and protects your information. We enforce a strict privacy-first, serverless architecture in full compliance with the Google API Services User Data Policy, GDPR, and CCPA.

1. Minimal Scopes & Information We Access

The Add-on operates serverless within the Google Workspace™ environment and requests strictly the minimal, non-sensitive OAuth scopes required for user interface rendering, active spreadsheet management, and identity verification:

  • https://www.googleapis.com/auth/spreadsheets.currentonly
    Data Access & Use: Strictly limited to the single active spreadsheet document where you explicitly open and run the Add-on. Used to read roster member names and UIDs, insert generated QR code images into designated cells, and log attendance check-in timestamps. The Add-on cannot access or view any other spreadsheets or files in your Google Drive™.
  • https://www.googleapis.com/auth/script.container.ui
    Data Access & Use: Allows the Add-on to display its modal dialogs and sidebars inside Google Sheets™ (including the Live Webcam Scanner sidebar, Attendance Analytics Dashboard, Settings modal, and printable badge view).
  • https://www.googleapis.com/auth/script.external_request
    Data Access & Use: Used solely to fetch high-resolution QR code rendering graphics from whitelisted endpoints (api.qrserver.com).
  • https://www.googleapis.com/auth/userinfo.email
    Data Access & Use: Used to securely recognize the logged-in user account for licensing and personalized settings.

2. Data Protection Mechanisms for Sensitive and User Data

To ensure the confidentiality, integrity, and security of your data, ConvertSharp implements comprehensive organizational and technical data protection mechanisms:

  • Encryption in Transit: All communications between the user's browser, the Google Sheets™ interface, the Google Apps Script execution engine, and whitelisted external endpoints are encrypted in transit using industry-standard Transport Layer Security (TLS 1.2 / TLS 1.3) protocols over HTTPS. Unencrypted or plain-text HTTP connections are strictly prohibited.
  • Encryption at Rest: ConvertSharp does not operate, manage, or maintain any external databases or cloud servers to store your attendance data. All roster records, student/employee identifiers, and attendance timestamps reside strictly within your personal Google Spreadsheet document, protected by Google Workspace™ enterprise-grade multi-tenant storage with AES-256 encryption at rest.
  • Access Control & Principle of Least Privilege: Access to user data is governed strictly by Google OAuth 2.0 authorization tokens. The Add-on adheres strictly to the principle of least privilege, utilizing narrow container-bound scopes (spreadsheets.currentonly). No human personnel, internal staff, or third parties have access to your spreadsheet data. All script executions run under the authenticated user's individual session context.
  • Client-Side Processing & Secure Sandboxing: All badge layouts, printable PDF exports, and dashboard analytics calculations occur entirely client-side inside the user's browser or within Google's isolated Apps Script sandbox container. No attendee data or spreadsheet contents are ever forwarded to external application servers.
  • Vulnerability Management & Code Audits: Our codebase undergoes rigorous regular security reviews and automated vulnerability checks adhering to OWASP Application Security Standards and Google Workspace Developer Policies.

3. Zero Broad Sensitive Scopes & Zero Google Drive / Forms Permissions

Strict Adherence to Minimum Necessary Scopes:

  • Zero Sensitive Google Drive Permissions: The Add-on does NOT request or use broad Google Drive permissions (such as drive or drive.readonly). All badge printing and PDF exports are handled client-side directly within your browser via native print protocols (Print to PDF), keeping your Google Drive™ completely untouched.
  • Zero Google Forms Permissions: The Add-on does NOT request or use any Google Forms permissions (forms or forms.body). It cannot read, modify, or delete any of your Google Forms. Attendance check-ins run through our secure direct Web App endpoint or voluntary client-side form submissions.
  • Narrow Scope Guarantee: By utilizing only spreadsheets.currentonly, we guarantee that our application cannot view, edit, or access any other Google Sheet or Drive document across your Google account.

4. Geolocation (GPS) Data Policy

When students or employees scan their attendance QR code on a mobile device, the browser may request optional HTML5 Geolocation permission:

  • Purpose: Geolocation coordinates (Latitude and Longitude) are captured exclusively to verify on-site presence and prevent proxy or remote attendance.
  • Storage: Coordinates are written directly into your Google Sheet™ document (under Column "GPS Location"). ConvertSharp does not track, store, or transmit this location data to any external server.
  • User Consent: Location access is subject to standard browser permissions. Users can choose to grant or deny access in their browser settings.

5. Serverless Architecture & Zero Third-Party Storage

Your roster, student identifiers, phone numbers, and attendance logs are 100% owned and stored within your private Google Workspace™ account. We do not maintain an external database of your students or employees, nor do we sell, rent, or monetize your data.

6. Google API Services User Data Policy Compliance

QR Code Attendance Tracking By ConvertSharp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

"QR Code Attendance Tracking By ConvertSharp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
  • We only use user data to provide or improve user-facing features that are prominent in the Add-on's user interface.
  • We do not transfer user data to third parties, advertising platforms, data brokers, or information resellers.
  • We do not use or transfer user data for serving advertisements.
  • Human personnel do not read your spreadsheet or attendance data.
  • Prohibited AI/ML Model Training: Google user data is never used to train, fine-tune, or develop artificial intelligence (AI) or machine learning (ML) models (generalized or personalized).

7. Children's Privacy (COPPA & FERPA Compliance)

Because our Add-on is widely used in educational institutions and schools, we take student privacy with the utmost seriousness:

  • We do not collect personal identifiers from students on our servers.
  • All student records reside exclusively inside the teacher's or school district's Google Workspace for Education tenant.
  • We fully comply with FERPA and COPPA principles.

8. Data Retention, Deletion, and Revocation Procedures

ConvertSharp provides users with complete and autonomous control over their data retention and deletion:

  • Data Retention Period: We do not retain any Google user data or sensitive data on external servers. All data accessed during the execution of the Add-on exists only in temporary session memory during the active execution cycle and is discarded immediately after execution terminates. Attendance records remain in your Google Sheet™ for as long as you choose to retain the file.
  • User-Initiated Data Deletion: Since all data is stored inside your own Google Sheet™, you have direct control. You can delete specific student rows, clear attendance logs, or permanently delete the entire spreadsheet at any time from Google Drive™ without requiring our assistance.
  • Revoking Application Access: You can revoke the Add-on's access to your Google account at any time. Visit your Google Account Security Settings at https://myaccount.google.com/permissions, locate "QR Code Attendance Tracking By ConvertSharp", and click "Remove Access". Once revoked, the Add-on immediately loses all ability to read or interact with your spreadsheet.
  • Deletion Assistance & Verification: Users may also contact our Data Protection Officer at [email protected] or [email protected] to request verification or assistance with data handling. Any such inquiries will be processed and confirmed within 48 business hours.

9. Contact Us

If you have any questions about this Privacy Policy, our data protection mechanisms, or wish to make an inquiry, please contact our Data Protection team:

ConvertSharp Data Protection & Support
Website: https://addon.convertsharp.com
Email: [email protected] / [email protected]