Privacy Policy

1. Information we collect

• Google account email — used as your tenant identifier and shown only to you.
• Google OAuth refresh token — issued by Google for the read-only Search Console scope (webmasters.readonly). It is used to query your Search Console properties on your behalf, and is never shared with third parties.
• API key hash — we store only a SHA-256 hash of your API key. The key itself is shown once and is not recoverable.
• Usage counters — request timestamps and per-day quota counts, used to enforce the daily limit and prevent abuse.

2. What we do not do

• We do not sell, rent or share your data with advertisers.
• We do not use your Search Console data to train machine learning models.
• We do not read Search Console properties you have not granted access to.

3. Where data is stored

Account records, tokens and hashed API keys are stored in a Supabase (PostgreSQL) database protected by row-level security, so each tenant can only reach its own row. The application is hosted on Vercel. Search Console data is fetched from Google's APIs on demand and is not persisted on our servers beyond the transient response returned to your client.

4. Cookies

We use a single first-party session cookie to keep you signed in. We do not use advertising cookies or third-party tracking pixels.

5. Retention and deletion

Your record is kept while the beta runs. You can revoke this app's access at any time at myaccount.google.com/permissions, which immediately stops all further data access. To have your stored record and hashed key deleted, email glq0546@gmail.com and we will remove it.

6. Changes

This is a free beta and this policy may change as the Service evolves. Material changes will be reflected on this page.

7. Contact

Questions about this policy: glq0546@gmail.com