Overview
Manual and scheduled syncs never send your Asana task data to our servers. They run inside Google's infrastructure and talk directly to Asana's API.
Live sync is the exception. To react to changes in Asana while your sheet is closed,
Asana sends change notices to our server, and the sections below say what we keep when you turn
it on.
Authentication
We use Asana's official OAuth 2.0 authentication. We never see or store your Asana password.
The add-on keeps your authentication tokens in Google's PropertiesService (your personal
Google account storage) and uses them only to talk to Asana's API. With live sync on, our
server also keeps an encrypted copy (see What We Store).
Asana's consent screen asks for full access to your account. Asana's narrower scopes do not
cover sections or workspace memberships, which the add-on needs. We use that access to read
the data listed below and, on the Business plan, to write the edits you make in your sheet.
You can revoke it at any time from your Asana account settings.
What Data We Access
The add-on accesses the following data from your Asana workspace:
- Tasks: Task data, sections, and subtasks from projects you choose to sync
- Custom Fields: Field definitions and values for synced tasks
- Time Entries: Time tracking data (if you use this feature)
- Users: Workspace member information (if you use this feature)
- Workspace Structure: Teams, projects, and portfolios for navigation
For manual and scheduled syncs, data flows directly from Asana to your Google Sheet. We do
not store it on our servers.
What We Store
- Sync Configuration: Your selected workspaces, projects, and sync settings
- OAuth Tokens: Encrypted Asana authentication tokens
- Subscription Status: Your plan tier and subscription ID for feature access
- Account Details: The Google and Asana email addresses tied to your subscription
For manual and scheduled syncs, the add-on keeps sync configuration and tokens in Google's
PropertiesService, tied to your Google account and spreadsheet.
With live sync on, our server also keeps the IDs of changed Asana tasks, briefly keeps
values written from your sheet so they don't bounce back, and holds encrypted copies of your
Asana and Google sign-ins so it can update the sheet while it's closed. Turn live sync off
and we stop using them.
Google Workspace Permissions
The add-on requests these Google OAuth scopes and no others:
- .../auth/spreadsheets reads and writes the spreadsheet you chose as the destination
for a sync
- .../auth/drive.file reaches only files you open with the add-on. It never lists
or searches your Drive
- .../auth/script.external_request lets the add-on call Asana's API and our own
backend
- .../auth/script.scriptapp creates the background triggers that run scheduled
syncs and pick up your sheet edits
- .../auth/script.container.ui shows the add-on's sidebar and dialogs
- .../auth/script.locale reads your language setting so dates and numbers show
in your format
- .../auth/userinfo.email and .../auth/userinfo.profile identify your installation, your plan and your trial
How We Use Google User Data
"Google user data" means the data the scopes above give us. We use every piece for one purpose
and nothing else:
- Your spreadsheet content: a sync reads it to tell which rows already exist, which
rows you edited and where each column belongs. It writes to it so Asana
tasks land in the tab you picked, and so rows you edit go back to Asana when two-way sync is on.
- Your Google account email and name identify your installation, apply your plan
and trial, tie a live sync to the person who set it up, and let us send you email about your own
account, like a trial ending or a failed payment.
- Your Google authorization for live sync is used only to
write changes into the spreadsheet you already picked.
It's never used to open, list or search any other file.
We don't sell Google user data. We don't share it with advertisers, data brokers or anyone
else for their own use. We don't use it for advertising, credit or lending decisions, and we
don't use it to train any AI or ML model. The add-on has no AI or ML part. We don't build
profiles of you or analyse what's in your spreadsheets.
How We Protect Your Data
- In transit. The add-on talks to Google, Asana and our backend over HTTPS with
TLS only.
- At rest. We encrypt the OAuth tokens our backend holds, Google and Asana alike,
with AES-256-GCM using a fresh random IV per token. The key is a server-side secret we never write
to the database, so a copy of the database alone gives no usable token.
- Tokens never reach a browser. Our backend decrypts them only at the moment it
uses them, and they never appear in a web page or a URL.
- Verified notifications. We check Asana's change notices against an HMAC-SHA256
signature before we act on them, so a forged notice can't write to your sheet.
- Least privilege. Tokens for manual and scheduled syncs stay in storage only your
Google account can read. Our backend keeps only what it needs to route a change.
- No human access. Our staff don't read your spreadsheets or your Asana
tasks. Only the people who run the service have production access, and they use it only to keep it
running, to look into abuse or a security problem, or when the law requires it. We ask before
looking at anything in your account for a support request.
Data Retention and Deletion
We keep no copy of your spreadsheets or your Asana tasks. They're read and written in place,
and only Google and Asana hold them. Here's everything we do keep, and for how long:
- Google refresh token (live sync): kept until you revoke the add-on's
access. Then we mark it revoked the next time it's used and delete it within 30 days. You
can revoke it any time at myaccount.google.com/permissions.
- Asana token (live sync): kept so live sync keeps working. We delete it if you
ask.
- Google account email: kept while your installation is active, so your plan and
trial work. We delete it if you ask.
- Spreadsheet and sheet ids: kept while the live sync that uses them exists. Turning
that live sync off deletes them.
- Pending sheet edits and echo records: we delete an edit within an hour of pushing
it to Asana. Echo records expire 5 minutes after we write them.
- Sync configuration: kept in Google's PropertiesService for as long as the sync
exists. Deleting a sync deletes it.
You can delete this yourself, without asking us:
- Disconnect in the add-on menu removes your Asana connection from your Google
account.
- Uninstalling the add-on removes what it stored in your Google account.
- Revoking access at myaccount.google.com/permissions withdraws the Google authorization directly.
To have everything we hold about you deleted, write to support@upsys-consulting.com. We'll erase it
within 30 days and tell you when it's done. The spreadsheets and tabs the add-on wrote are
yours, and we never delete them.
Limited Use of Google User Data
Our use of information we receive from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms:
- We use Google user data only to provide and improve the sync features on this page.
- We don't sell it or transfer it to data brokers or advertisers.
- We don't use it for advertising, credit or lending decisions.
- We don't use it to develop, improve or train any AI or ML model, and we don't pass it to any
service that would.
- People don't read your data unless you've allowed it for a support request, security calls
for it (looking into abuse, say), or the law requires it.
Third-Party Services
The add-on and this site work with:
Asana to Sheets is made by UpSys. It is not affiliated with, endorsed by, or sponsored by Asana, Inc. Asana is a trademark of Asana, Inc. Google Workspace™, Google Sheets™, and Google Drive™ are trademarks of Google LLC.
Analytics
Our marketing website uses Umami, a
privacy-focused analytics tool that does not use cookies and does not collect personal
information.
Our website notes how you first found us. It reads the campaign tags in the address you arrived
on (like utm_source) and the website that sent you, plus the first page you saw
and the date. It keeps that in your browser's local storage for 90 days, not in a cookie, and
adds it to the link when you go to the pricing page or checkout. If you buy a plan, we keep
those details with your subscription in Stripe and in our own records, so we know which
channels bring paying customers.
The add-on sends usage events, like a sync starting or finishing and how many rows it wrote, to
our own Umami server, tagged with your Google account email so we can help you when you write to
support. They never carry spreadsheet content or Asana
tasks.