Why Google shows a warning
The first time you open Grant Tracker in your copy, Google shows "Google hasn't verified this app". Here is what that means, plainly.
What you will see
- Authorization required. "A script attached to this document needs your permission to run." Click Continue and choose your Google account.
- Google hasn't verified this app. Click Advanced at the bottom left, then Go to Tidyfield Grant Tracker (unsafe).
- The permissions. Google lists what the script may do (see below). Click Allow.
- Open Extensions > Tidyfield Grant Tracker > Open sidebar again.
The exact words and buttons can vary a little between accounts and languages.
Why it appears
When you make a copy, Google also copies the spreadsheet's script, and that copy belongs to you. It runs in your Google account, not on a Tidyfield server. Google reviews apps that many people install, such as Marketplace add-ons. A script you own has not been through that review, so Google shows this warning before it first runs. The warning may even name your own email as the developer, because the copy is yours.
Grant Tracker is sold this way so that your data and the code stay in your account.
What each permission is for
| Google asks to | Why Grant Tracker needs it |
|---|---|
| View and manage spreadsheets that this application has been installed in | To build and update the tracker tabs in this spreadsheet. It cannot open your other files. |
| Make secondary Google calendars, and see, create, change and delete events on them | For the shared calendar of deadlines, if you turn it on. It can only touch calendars it created, never your own calendars. |
| Send email as you | For the daily reminder email, if you turn it on. It only goes to the addresses you enter. |
| Connect to an external service | To check your license with Lemon Squeezy and to read the version number on this website once a day. The script can only contact the addresses listed in its manifest. |
| Allow this application to run when you are not present | For the daily email and calendar updates, if you turn them on. |
| Display and run third-party web content in prompts and sidebars | To show the sidebar and the import window. |
| See your primary Google Account email address | To show who set up the email schedule and to send a test email to you. |
Check it yourself
- Open Extensions > Apps Script in your copy to read every file of the code.
- The file
appsscript.jsonlists the permissions (oauthScopes) and the only web addresses the script may contact (urlFetchWhitelist).
If your organization uses Google Workspace
If your administrator blocks scripts that are not approved, ask them to allow it, or use the spreadsheet template, which has no script.
Tidyfield never receives your grant data. The only Tidyfield address your copy contacts is grants.tidyfieldapps.com/version.json, to tell you when a newer version exists; that request carries nothing about you. Privacy policy