--- title: "Can other users see my data? · GSC PAP" source: https://gscpap.com/faq/can-other-users-see-my-data updated: 2026-10-27 --- [All questions](https://gscpap.com/faq) Privacy & Security # Can other users see my data? By the [GSC PAP team](https://gscpap.com/about) · Updated October 27, 2026 No. Your Search Console data, OAuth tokens, MCP sessions, archive, and tool call history are all isolated to your user account in our database. Every query passes through bearer-token authentication that resolves to a specific user, and every database query scopes results by user_id. There is no UI, API endpoint, or feature that exposes one user's data to another user. This isolation is enforced at multiple layers: row-level filtering in every Postgres query, application-layer middleware that fails closed if user_id is missing from a request, and rate limits scoped per-user so one user's traffic cannot affect another's quota. The Personal Archive uses partitioned tables but the partition key is date, not user - rows from all users coexist physically but are filtered logically by user_id on every read. The one exception is the operator (us), and it is narrow. A person on our side looks at an individual account's data only for support you asked for, to investigate a bug or abuse, or when the law requires it, and every such access is written to an audit log with the reason. Otherwise we work only with aggregates that identify no account. We never sell your data, and never use it to train AI models. If you delete your account, your data is deleted within 30 days of the request. The Privacy Policy has the details. ## Related questions [All questions](https://gscpap.com/faq) [ Privacy & Security ### What Search Console data can GSC PAP access? GSC PAP requests the webmasters.readonly OAuth scope - the same read-only level you would grant to any third-party Search Console viewer. Specifically we can read your verified site list, search analytics (clicks, impressions, CTR, position by query, page, country, device, date), sitemap submission status, and URL inspection results. This is exactly the data you see in your own Search Console UI. It also has the same gaps: Google leaves anonymized queries out of query rows in both the UI and the API, so GSC PAP cannot reveal them either. If you also connect Google Analytics, GSC PAP holds the analytics.readonly scope as well, and any Analytics data it keeps for you follows the same rules as your archive. ](https://gscpap.com/faq/what-data-does-gsc-pap-access)[ Privacy & Security ### How do I revoke access? You have three independent ways to revoke. First, revoke a single MCP token from /account/tokens - this kills only that bearer, leaving other tokens (e.g. on different machines) working. Useful if you suspect one token has been exposed but want to keep using GSC PAP elsewhere. ](https://gscpap.com/faq/how-to-revoke-access)[ Limits & Pricing ### Does GSC PAP use fewer tokens than calling the Search Console API directly? Yes, about a third fewer. We measured it on 1,000 real rows from three different properties, serialising the same rows two ways: the shape the Search Console API returns, and the compact format our server sends. The raw API response came to 34,044, 34,535 and 36,237 tokens. The same data from GSC PAP came to 22,933, 23,260 and 23,975. That is 33 to 34% fewer tokens for identical numbers, measured with tiktoken cl100k_base. ](https://gscpap.com/faq/token-usage-vs-search-console-api) ### All your Search Console superpowers in chat Stop tab-switching between GSC, GA4, and PageSpeed. 36 tools route through one MCP your AI assistant already speaks. [See what's available](https://gscpap.com/tools) **Your Search Console data, in chat, in 60 seconds** Stop CSV-exporting GSC data. Sign in with Google to ask in chat. [Sign in with Google](https://app.gscpap.com/login) Did this answer your question? If not, email [support@gscpap.com](mailto:support@gscpap.com) and we will revise.