In short

GSC PAP is a hosted bridge that lets AI assistants (Claude, ChatGPT, Cursor and any other MCP client) read your Google Search Console and, if you connect it, Google Analytics 4 data on your behalf. It also keeps a long-term archive of your Search Console data, so you can query it beyond Google's 16-month limit.

We store your Google email and an encrypted OAuth refresh token so we can call Google's APIs for you when your assistant asks.
We keep a copy of your Search Console data (your Personal Archive) and may keep Analytics data we fetch for you under the same rules. Only you and the AI clients you connect can query it.
We use your data to run the features you use and to improve them. A person on our side looks at an individual account's data only for support you asked for, to investigate a bug or abuse, or when the law requires it. Every such look is logged.
We do not sell your data, and we share it only with the providers that run the Service (§4).
Any new use of your data needs your consent first. We update this policy, email you, and ask in the product before your data is used in a way this page does not describe.
You can delete your account at any time. Your data is then deleted within 30 days.

1. Who we are

GSC PAP (this site) is operated by GSC PAP (Personal project (independent operator)). Contact: support@gscpap.com.

For the purposes of GDPR, KVKK and similar regulations, we are the data controller for the data described below.

2. Data we collect

2.1 At sign-in (Google OAuth)

Google account ID (the stable sub claim)
Email address (verified by Google)
Display name (if your Google profile has one)

2.2 OAuth tokens and scopes

Google issues your account a refresh token at consent. We store it AES-256-GCM encrypted at rest using envelope encryption (per-row data key, master key kept outside the database). The scopes are read-only: webmasters.readonly for Search Console, and analytics.readonly when you connect Google Analytics. Neither lets us change anything in your accounts.

2.3 MCP session tokens

When you click Generate token, we mint a random bearer token, show it to you once, and store only its SHA-256 hash. The plaintext bearer never lives in our database. The hash is what we look up when an AI client connects.

2.4 Usage log (tool calls)

Each MCP tool call is logged with: tool name, a summary of the parameters (for example the site URL and date range), result status and latency. We keep it for 90 days, then delete it.

2.5 Personal Search Console Archive

We fetch your Search Console data through Google's API and store a copy in our database: search analytics rows (query, page, country, device, date, clicks, impressions, CTR, position), Search Console's daily totals, URL inspection results and sitemap metadata. This is what lets you query data beyond Google's 16-month limit.

Visibility: the archive is tied to your account. You and the AI clients you connect can query it; no other GSC PAP user can. Our access is limited as described in §3.

2.6 Google Analytics and PageSpeed data

When your assistant asks a Google Analytics question, we fetch the answer from Google's Analytics Data API and return it. We may keep a copy of the Analytics data we fetch for you, to answer repeat questions faster and to keep its history. Any such copy is part of your Personal Archive: tied to your account, visible only to you and your AI clients, and kept and deleted on the same terms (§6). PageSpeed Insights results describe public web pages, not your accounts; we cache them to save Google quota.

2.7 Emails

We send account emails (welcome, reconnect reminders) and, if you have not unsubscribed, a weekly summary of your Search Console numbers. We log which emails we sent to you. Every non-essential email has a one-click unsubscribe link.

2.8 Audit log

Account events (sign-in, token changes, account deletion) and every operator access to account data are recorded for security. The audit log does not contain your Search Console or Analytics data.

2.9 Technical data

IP address, browser User-Agent and timestamps, used to bind the sign-in flow to your browser, to apply rate limits and to diagnose blocked requests. The web app also keeps two values in your browser's local storage and sends them only to our own API: a random browser ID (gp_vid) and where your first visit came from (gp_first_touch: referrer and utm_ tags). When you sign up, the latter is saved with your account so we know which channels bring people to the Service.

3. How we use your data

To run the features you use: answering your AI client's tool calls, building and updating your archive, and sending the emails described in §2.7.
To keep the Service working and improve it: automated processing to find and fix bugs, measure performance and build features, and aggregate statistics (such as how often each tool is called) for our internal operations.
For security: detecting abuse, fraud and attacks.

3.1 When a person looks at your data

Someone on our side views an individual account's data only:

to give support you have asked for,
to investigate a bug, a security incident or suspected abuse,
when the law requires it.

Outside those cases we work only with aggregated data that does not identify an account. Every access to account data is logged with who accessed it, which account, when, and the stated reason.

3.2 What we do not use it for

Advertising, marketing to others, or profiling
Training AI models
Credit, lending or any decision about you

3.3 New uses need your consent

If we want to use your data in a way this policy does not describe (for example, a benchmark that compares your site with anonymized figures drawn from many accounts), we will first update this policy, email you, and ask for your consent in the product. If you do not consent, your data is left out. Nothing of the kind exists today.

Legal basis under GDPR Art. 6(1): performance of a contract (b) for the service and your archive; legitimate interests (f) for security, debugging, abuse prevention and aggregate statistics; consent (a) for any new use under §3.3. You can object to processing based on legitimate interests by emailing us or by deleting your account.

4. Who we share it with

We do not sell, rent or trade your data. No other GSC PAP user can see your data. The only parties that receive it are the providers that run the Service, each for that purpose alone:

Google LLC (USA): sign-in, and the Search Console, Analytics Data and PageSpeed Insights APIs we call on your behalf. Also Google Analytics for our own website traffic (§5).
Contabo GmbH (Germany): the servers that run the Service and hold the database, located in the European Union.
Cloudflare, Inc. (USA, global network): serves gscpap.com and app.gscpap.com, carries API and MCP traffic to our servers, runs the Turnstile bot check, and delivers our emails.
Serper (serper.dev): runs the live Google searches behind the search-results tools. It receives the search query, country and language your assistant asks for, never your account details.
Authorities, only when the law requires it and limited to what is required.
A buyer or successor, if GSC PAP is ever merged or sold, and only after you have given explicit prior consent.

GSC PAP's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Cookies and analytics

We use essential cookies and one analytics provider. No marketing pixels, no advertising networks, no profile selling.

Essential cookies (no consent required):

gscpap_session: signed session set after Google sign-in. HttpOnly, SameSite=Lax, Secure, expires in 1 year.
gscpap_known: non-secret companion flag (1/0) so the static landing renders the right header button on first paint.
gscpap_oauth_nonce: short-lived OAuth flow nonce. HttpOnly, scoped to /auth/google, expires in 10 minutes.
cf_clearance: set by Cloudflare Turnstile after a human-verification challenge to prevent bot floods. Required for the API to accept requests.

Analytics (Google Analytics 4):

We send page views to Google Analytics 4 (property G-7VFMNP7705) so we can count visitors, see which guides people read, and prioritise improvements. IP anonymisation is on, so GA4 never receives your full IP.
On gscpap.com a small script keeps a random visitor ID in your browser's local storage. On app.gscpap.com Google's gtag.js sets the _ga and _ga_* cookies (1-year retention).
We send no personal information to GA4: no email, no name, no account ID, no site URLs and nothing from your Search Console or Analytics data. IDs in page addresses are replaced with ":id" and query strings are reduced to utm_ tags before anything is sent. Admin pages send no page views.
To opt out, use a tracker blocker (uBlock Origin, Brave Shields, Google's GA opt-out add-on) or clear the _ga* cookies and local storage. The rest of the site keeps working.

We will add an opt-in consent banner if and when we introduce marketing or behavioural-tracking cookies. Today we don't use any.

6. Data retention

Account and encrypted refresh token: kept while your account exists, deleted within 30 days of account deletion.
MCP sessions (token hashes): kept while un-revoked. Marked revoked immediately on sign-out, token revocation or account deletion.
Personal Archive (Search Console data, and any Analytics data we keep for you): kept while your account exists. Revoking GSC PAP's access at Google stops new data from being added but does not delete the archive, so your history is still there if you reconnect. Deleting your account deletes it within 30 days. You can ask for earlier deletion of specific properties or date ranges by emailing support.
Usage log: 90 days.
Email log: kept while your account exists, so we do not send the same email twice.
Audit log: 5 years, for security. It never contains Search Console or Analytics data.
Server logs: at most 30 days.
Aggregate statistics that do not identify any account (such as daily tool-call counts) may be kept for the life of the Service.

Signing in again within 30 days of deleting your account restores it, which is why deletion completes after that window rather than at once.

7. Your rights

Under GDPR, KVKK (Law No. 6698), and similar regulations you have the right to:

Access the data we hold about you
Correct inaccurate data
Delete your account and associated data
Receive a portable export of your data
Object to processing
Withdraw consent (revoke OAuth)
Lodge a complaint with your local data protection authority

Most of these are available self-service from your account dashboard:

Delete account: Security → Delete account
Revoke at Google's side: myaccount.google.com/permissions

For data export or any other request, email support@gscpap.com. We respond within 30 days.

8. Security

OAuth refresh tokens are AES-256-GCM encrypted at rest
Bearer tokens are stored only as SHA-256 hashes
HTTPS-only in production
OAuth flows use PKCE (S256) per OAuth 2.1
State binding (request fingerprint + HttpOnly nonce cookie)
Per-user rate limiting on MCP requests

We do not offer end-to-end encryption, where even we could not read your data. The archive, the background sync that keeps it current, and support all need the server to read it. If zero-knowledge storage is a hard requirement for you, this product is not the right fit.

9. International transfers

The Service runs on servers in the European Union, rented from Contabo GmbH. Google and Cloudflare process data in the United States and on their global networks; both take part in the EU-U.S. Data Privacy Framework. By using the Service you acknowledge that your data is processed in these places for the purposes in §3.

10. Changes to this policy

We publish each new version here with its effective date and email active users at least 14 days before a material change takes effect. A change that would use your data in a new way also asks for your consent first (§3.3).

11. Contact

Questions, requests, or complaints: support@gscpap.com.

Operator: GSC PAP (Personal project (independent operator)). See also the Terms of Use and the KVKK notice.