In short: WooSheet Sync syncs the store catalog fields you choose to a selected Google spreadsheet. The store’s Google tokens are encrypted in its WordPress database. The publisher’s broker handles OAuth exchanges and keeps only short-lived encrypted tickets.
1. Who provides WooSheet Sync
WooSheet Sync is published by ClientSync. This policy describes the plugin, the publisher-managed OAuth broker, and this product information website. The merchant operating a WooCommerce store remains responsible for its own customer privacy notices and store data practices.
2. Information the plugin processes
When a merchant exports or syncs a catalog, WooSheet Sync processes the product fields supported by the plugin, including product IDs, parent IDs, SKUs, names, product types, prices, stock quantities and settings, product status, attributes, and categories. These fields are written to or read from the spreadsheet selected by the merchant.
The plugin uses Google's drive.file permission. The user selects the spreadsheet in Google Picker and grants Google access to the files used with WooSheet Sync. The plugin does not request general access to every file in the user's Drive.
3. Google account connection
The publisher-managed OAuth broker at auth.clientsync.online receives the Google authorization response and exchanges it with Google. It temporarily stores the resulting token data as an encrypted, single-use ticket while the store completes the connection. Tickets expire after three minutes and expired tickets are cleaned up during broker requests.
The store’s WordPress server redeems the one-time ticket using a PKCE verifier. The long-lived Google refresh token is then stored encrypted in that store’s WordPress options using AES-256-GCM and a key derived from the WordPress authentication salt. The broker uses the refresh token to request new short-lived access tokens when needed; it does not keep a long-term copy of the store’s token.
Changing a store’s WordPress authentication salts can make its saved token unreadable, in which case the merchant must reconnect Google.
4. Where information is stored and shared
Catalog data is stored in the merchant’s WooCommerce database and in the Google spreadsheet the merchant selects. OAuth tokens are stored encrypted on the merchant’s WordPress site. The OAuth broker temporarily processes authorization tickets to complete the connection and refresh access tokens.
Information is sent to Google to provide the selected spreadsheet connection and synchronization. The publisher does not sell this information or use it for advertising. Google’s handling of data is governed by Google’s own terms and privacy policies. The merchant’s hosting provider may also process information as part of hosting the WordPress site and broker.
5. Sync activity and diagnostics
The plugin keeps recent sync events on the merchant’s WordPress site to show applied changes, conflicts, and rejected edits. Events can include product IDs, field names, row numbers, and sanitized diagnostic messages. An invalid category entry may be reflected in a rejection message. Plugin event history is periodically pruned, with a 90-day retention threshold.
6. Retention and deletion
Catalog rows remain in the merchant’s WooCommerce store and selected spreadsheet until the merchant changes or removes them. Disconnecting Google revokes the connection where possible and removes the saved token and spreadsheet selection from the plugin settings; it does not delete the spreadsheet or product data. Uninstalling the plugin preserves its settings and tokens by default. The merchant can delete those items from WordPress and Google separately.
OAuth tickets are single-use and expire after three minutes. Routine web server logs may retain connection metadata according to the relevant hosting provider’s practices.
7. Security
The plugin encrypts saved Google tokens in WordPress. The broker uses HTTPS, signed OAuth state, PKCE, short-lived one-use tickets, and encryption for temporary ticket data. No internet service can guarantee absolute security; merchants should keep WordPress, hosting accounts, and Google accounts secured and up to date.
8. Your choices
Merchants choose which spreadsheet to connect, which supported fields to edit, and whether to disconnect Google. Google access can also be reviewed or revoked from the user's Google Account settings. For questions about this policy or the publisher’s handling of broker data, use the contact information available at clientsync.tech.
9. Changes to this policy
This policy may be updated if the product’s data handling changes. The current version and effective date will be posted on this page.