Privacy Policy

monday.com Exporter, published by Cody Labs. Effective 2 August 2026.

monday.com Exporter (the "add-on") moves your monday.com data into your own Google Sheets. This policy explains what the add-on accesses and how that data is handled. The short version: your data flows directly between your monday.com account and your Google Sheet. Cody Labs operates no servers and never receives, stores, or transmits your board data or your monday API token.

Information the add-on accesses

A monday.com personal API token you provide, used to authenticate to the monday.com API on your behalf. The add-on never requests write access to your boards.
Board data, the items, subitems, and column values returned by the boards you choose to export.
The active Google Spreadsheet, only the spreadsheet you run the add-on in (via the restricted spreadsheets.currentonly scope). The add-on cannot see your other files in Google Drive.

Where your data goes

All processing happens inside Google's Apps Script runtime, in your Google account. Board data is fetched from your monday.com account and written into your spreadsheet. It is not sent to Cody Labs or any third party. We have no database and no server that could receive it.

How your monday API token is stored

Your monday personal API token is stored using Google's PropertiesService (user properties), scoped to your Google account. It is never written into the spreadsheet and is not visible to other people you share the sheet with. It remains until you disconnect or uninstall the add-on, at which point it is removed.

License verification

If you enter a license key to unlock paid features, the add-on sends only that license key and a product identifier to our payment processor, Gumroad, to confirm your subscription is active. No monday.com data is involved. See Gumroad's privacy policy.

How the add-on uses Google user data

The only Google user data the add-on accesses is the content of the single Google Sheets spreadsheet you open it in, through the spreadsheets.currentonly scope. It uses that data for one purpose only: to write the monday.com report rows you choose to export, plus status notes and a run log, into that same spreadsheet, and to read back the cells it previously wrote so it can update or resume an export you have set up. The add-on:

never reads or writes any other file in your Google Drive (the spreadsheets.currentonly scope makes this technically impossible);
never uses your Google user data for advertising, profiling, or training any model;
never sells your Google user data or shares it with third parties; and
never transmits it to Cody Labs or any external server, all processing runs inside Google's Apps Script runtime under your own account.

The add-on's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Data protection & security

We protect your data, including any sensitive data, with the following mechanisms:

Encryption in transit: every network request (to the monday.com API, and to Gumroad for license checks) is made over encrypted HTTPS/TLS.
Encrypted, isolated credential storage: your monday API token is held in Google's PropertiesService user-property store, encrypted at rest by Google and scoped to your own Google account. It is never written into the spreadsheet and is never exposed to other people you share the sheet with.
Least-privilege access: the add-on requests only the narrow spreadsheets.currentonly, script.container.ui, script.external_request, and script.scriptapp scopes, so it can only ever touch the active spreadsheet, the endpoints described above, and its own scheduled triggers, never your wider Google Drive or account.
Read access only: this add-on only reads monday.com data into your spreadsheet; it never writes back to your monday.com account.
No developer-side attack surface: Cody Labs runs no servers and no database, so your Google user data and your monday.com data are never received, stored, or processed on our systems, there is no back end that could be breached.
Immediate revocation: disconnecting or uninstalling the add-on removes the stored monday API token and revokes its access straight away.

Data retention & deletion

Because we store nothing on our own systems, there is nothing for us to retain or delete. Your monday API token and settings live in your Google account's add-on storage and are removed when you disconnect or uninstall. Report data lives in your spreadsheet, under your control.

Third-party services

monday.com: your own monday.com account, accessed with the monday API token you supply.
Gumroad: used only to verify license keys for paid subscriptions.

Changes

We may update this policy; material changes will be reflected by the effective date above.

Contact

Questions about this policy: [email protected].

monday.com and Google Sheets are trademarks of their respective owners. This add-on is independent and is not affiliated with or endorsed by either.