Security & Privacy

Read-only by design

When you connect Google Analytics or Search Console, we request read-only access only. The exact scopes we use are:

• https://www.googleapis.com/auth/analytics.readonly
• https://www.googleapis.com/auth/webmasters.readonly

These scopes let us read your GA4 and Search Console metrics so we can render your dashboard. They do not grant any ability to write, modify, publish, or post anything. The app can never change your website, your Google Analytics configuration, or your Search Console settings.

How your data is stored

To pull your metrics on a schedule, Google issues us a refresh token. We encrypt that token at rest (AES, using a server-side encryption key) before it touches our database. It is decrypted only in memory at the moment we fetch your data.

The data we store is your own analytics: unique visitors and pageviews, sessions and dwell time, plus Search Console clicks, impressions, and average positions. It lives in our database on Cloudflare D1 and is used for one purpose only — to render your dashboard.

We never sell your data

We do not sell, rent, or share your data with third parties. Your metrics exist to power your own reporting, and nothing else.

You're in control

You decide what we can see, and you can take it back at any time:

• Disconnect an integration in the app to stop all future data pulls.
• Revoke access directly from your Google Account permissions at any time.
• Delete your account from settings, which removes your stored data.

We follow GDPR-friendly practices around access, control, and deletion.

Infrastructure

The application runs on Cloudflare Workers, with authentication handled by Better Auth and Google OAuth. Your data is stored in Cloudflare D1.

Questions

If you have any questions about security or privacy, please contact us.