Privacy Policy

What we access

• Your Google account email and basic profile, to sign you in.
• Search Console data (read-only,webmasters.readonly) and Analytics data (read-only,analytics.readonly) for the properties you explicitly authorize. We never write to, modify, or delete anything in your Google accounts.
• Index status of your pages, using the Search Console URL Inspection API under the same read-only Search Console access. To know which pages to check, DataApp reads the sitemaps submitted in your Search Console property (fetching them only from that property's own domain) and the pages that appear in your search data.
• Bing Webmaster Tools data (read-only,webmaster.read), only if you connect a Bing account: the list of your verified sites and their search traffic, query and page statistics. We never change anything in your Bing account.

How we use it

We fetch your authorized metrics and store them in our database so we can display fast dashboards and trends. Your Google OAuth refresh token is encrypted at rest and used only to refresh your own data on a schedule. We do not use your data for advertising or profiling.

How we protect your data

Search Console and Analytics data, and the OAuth tokens used to fetch it, are treated as sensitive data and protected as follows.

• Encryption in transit. All traffic between you and DataApp, and between DataApp and Google's and Microsoft's APIs, travels over HTTPS/TLS.
• Encryption at rest. Our database is encrypted at rest. Your Google and Bing refresh and access tokens are additionally encrypted by DataApp using AES-256-GCM authenticated encryption before they are written, with a 256-bit key held as an environment secret outside the database and never committed to source control.
• Access control. Every table holding your Google data enforces row-level security in the database, so rows are readable only by the account that authorized them. One user cannot read another user's Search Console or Analytics data.
• Least privilege. We request read-only scopes only, so we have no technical ability to create, modify or delete anything in your Google account.
• Limited access. Access to production systems is restricted to the operator of this service and used only to run and support the app.

Google API Services — Limited Use

DataApp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing & retention

We do not sell your data, and we do not share it with third parties. We retain the data we have fetched for as long as your account is active.

You can revoke DataApp's access to your Google account at any time from your Google account permissions. Revoking takes effect immediately and stops all further collection: our stored token stops working, and we cannot fetch anything further from your account.

You can also delete everything from inside DataApp at any time. Open Connections and choose Disconnect on a Google account. This revokes DataApp's access at Google and permanently deletes that account's stored tokens, its properties, and every Search Console and Analytics row we pulled through it. The deletion is immediate and cannot be undone. (If another DataApp user has connected the same Google account, we delete your copy of the token but leave the Google grant in place so their connection keeps working; you can still revoke it yourself from your Google account permissions.)

Bing. Disconnecting a Bing account in Connections permanently deletes its stored tokens, its sites and every Bing row we pulled. Bing offers no way for apps to revoke their own access, so to also withdraw DataApp's access at Microsoft, remove it in Bing Webmaster Tools under Settings › API Access.

If you would prefer we did it for you, or you want your whole DataApp account removed, email privacy@dataapp.cc and we will action it within 30 days.

Contact

Questions? Email privacy@dataapp.cc.