--- title: "Privacy Policy · GSC PAP" source: https://gscpap.com/privacy updated: 2026-10-27 --- # Privacy Policy Version 1.1 · Effective October 27, 2026 ## In short GSC PAP is a hosted bridge that lets AI assistants (Claude, ChatGPT, Cursor and any other MCP client) read your **Google Search Console** and, if you connect it, **Google Analytics 4** data on your behalf. It also keeps a long-term archive of your Search Console data, so you can query it beyond Google's 16-month limit. - **We store your Google email and an encrypted OAuth refresh token** so we can call Google's APIs for you when your assistant asks. - **We keep a copy of your Search Console data** (your Personal Archive) and may keep Analytics data we fetch for you under the same rules. Only you and the AI clients you connect can query it. - **We use your data to run the features you use and to improve them.** A person on our side looks at an individual account's data only for support you asked for, to investigate a bug or abuse, or when the law requires it. Every such look is logged. - **We do not sell your data,** and we share it only with the providers that run the Service (§4). - **Any new use of your data needs your consent first.** We update this policy, email you, and ask in the product before your data is used in a way this page does not describe. - You can delete your account at any time. Your data is then deleted within 30 days. ## 1\. Who we are GSC PAP (this site) is operated by **GSC PAP** (Personal project (independent operator)). Contact: [support@gscpap.com](mailto:support@gscpap.com). For the purposes of GDPR, KVKK and similar regulations, we are the _data controller_ for the data described below. ## 2\. Data we collect ### 2.1 At sign-in (Google OAuth) - **Google account ID** (the stable `sub` claim) - **Email address** (verified by Google) - **Display name** (if your Google profile has one) ### 2.2 OAuth tokens and scopes Google issues your account a **refresh token** at consent. We store it **AES-256-GCM encrypted at rest** using envelope encryption (per-row data key, master key kept outside the database). The scopes are read-only: `webmasters.readonly` for Search Console, and `analytics.readonly` when you connect Google Analytics. Neither lets us change anything in your accounts. ### 2.3 MCP session tokens When you click _Generate token_, we mint a random bearer token, show it to you once, and store only its **SHA-256 hash**. The plaintext bearer never lives in our database. The hash is what we look up when an AI client connects. ### 2.4 Usage log (tool calls) Each MCP tool call is logged with: tool name, a summary of the parameters (for example the site URL and date range), result status and latency. We keep it for **90 days**, then delete it. ### 2.5 Personal Search Console Archive We fetch your Search Console data through Google's API and **store a copy** in our database: search analytics rows (query, page, country, device, date, clicks, impressions, CTR, position), Search Console's daily totals, URL inspection results and sitemap metadata. This is what lets you query data beyond Google's 16-month limit. **Visibility**: the archive is tied to your account. You and the AI clients you connect can query it; no other GSC PAP user can. Our access is limited as described in §3. ### 2.6 Google Analytics and PageSpeed data When your assistant asks a Google Analytics question, we fetch the answer from Google's Analytics Data API and return it. We may keep a copy of the Analytics data we fetch for you, to answer repeat questions faster and to keep its history. Any such copy is part of your Personal Archive: tied to your account, visible only to you and your AI clients, and kept and deleted on the same terms (§6). PageSpeed Insights results describe public web pages, not your accounts; we cache them to save Google quota. ### 2.7 Emails We send account emails (welcome, reconnect reminders) and, if you have not unsubscribed, a weekly summary of your Search Console numbers. We log which emails we sent to you. Every non-essential email has a one-click unsubscribe link. ### 2.8 Audit log Account events (sign-in, token changes, account deletion) and every operator access to account data are recorded for security. The audit log does not contain your Search Console or Analytics data. ### 2.9 Technical data IP address, browser User-Agent and timestamps, used to bind the sign-in flow to your browser, to apply rate limits and to diagnose blocked requests. The web app also keeps two values in your browser's local storage and sends them only to our own API: a random browser ID (`gp_vid`) and where your first visit came from (`gp_first_touch`: referrer and utm\_ tags). When you sign up, the latter is saved with your account so we know which channels bring people to the Service. ## 3\. How we use your data - **To run the features you use**: answering your AI client's tool calls, building and updating your archive, and sending the emails described in §2.7. - **To keep the Service working and improve it**: automated processing to find and fix bugs, measure performance and build features, and aggregate statistics (such as how often each tool is called) for our internal operations. - **For security**: detecting abuse, fraud and attacks. ### 3.1 When a person looks at your data Someone on our side views an individual account's data only: - to give support you have asked for, - to investigate a bug, a security incident or suspected abuse, - when the law requires it. Outside those cases we work only with aggregated data that does not identify an account. **Every access to account data is logged** with who accessed it, which account, when, and the stated reason. ### 3.2 What we do not use it for - Advertising, marketing to others, or profiling - Training AI models - Credit, lending or any decision about you ### 3.3 New uses need your consent If we want to use your data in a way this policy does not describe (for example, a benchmark that compares your site with anonymized figures drawn from many accounts), we will first update this policy, email you, and ask for your consent in the product. If you do not consent, your data is left out. Nothing of the kind exists today. Legal basis under GDPR Art. 6(1): performance of a contract (b) for the service and your archive; legitimate interests (f) for security, debugging, abuse prevention and aggregate statistics; consent (a) for any new use under §3.3. You can object to processing based on legitimate interests by emailing us or by deleting your account. ## 4\. Who we share it with **We do not sell, rent or trade your data.** No other GSC PAP user can see your data. The only parties that receive it are the providers that run the Service, each for that purpose alone: - **Google LLC** (USA): sign-in, and the Search Console, Analytics Data and PageSpeed Insights APIs we call on your behalf. Also Google Analytics for our own website traffic (§5). - **Contabo GmbH** (Germany): the servers that run the Service and hold the database, located in the European Union. - **Cloudflare, Inc.** (USA, global network): serves gscpap.com and app.gscpap.com, carries API and MCP traffic to our servers, runs the Turnstile bot check, and delivers our emails. - **Serper** (serper.dev): runs the live Google searches behind the search-results tools. It receives the search query, country and language your assistant asks for, never your account details. - **Authorities**, only when the law requires it and limited to what is required. - **A buyer or successor**, if GSC PAP is ever merged or sold, and only after you have given explicit prior consent. GSC PAP's use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ## 5\. Cookies and analytics We use essential cookies and one analytics provider. No marketing pixels, no advertising networks, no profile selling. Essential cookies (no consent required): - `gscpap_session`: signed session set after Google sign-in. HttpOnly, SameSite=Lax, Secure, expires in 1 year. - `gscpap_known`: non-secret companion flag (1/0) so the static landing renders the right header button on first paint. - `gscpap_oauth_nonce`: short-lived OAuth flow nonce. HttpOnly, scoped to `/auth/google`, expires in 10 minutes. - `cf_clearance`: set by Cloudflare Turnstile after a human-verification challenge to prevent bot floods. Required for the API to accept requests. Analytics (Google Analytics 4): - We send page views to **Google Analytics 4** (property `G-7VFMNP7705`) so we can count visitors, see which guides people read, and prioritise improvements. IP anonymisation is on, so GA4 never receives your full IP. - On gscpap.com a small script keeps a random visitor ID in your browser's local storage. On app.gscpap.com Google's gtag.js sets the `_ga` and `_ga_*` cookies (1-year retention). - We send no personal information to GA4: no email, no name, no account ID, no site URLs and nothing from your Search Console or Analytics data. IDs in page addresses are replaced with ":id" and query strings are reduced to utm\_ tags before anything is sent. Admin pages send no page views. - To opt out, use a tracker blocker (uBlock Origin, Brave Shields, Google's GA opt-out add-on) or clear the `_ga*` cookies and local storage. The rest of the site keeps working. We will add an opt-in consent banner if and when we introduce marketing or behavioural-tracking cookies. Today we don't use any. ## 6\. Data retention - **Account and encrypted refresh token:** kept while your account exists, deleted within 30 days of account deletion. - **MCP sessions (token hashes):** kept while un-revoked. Marked revoked immediately on sign-out, token revocation or account deletion. - **Personal Archive** (Search Console data, and any Analytics data we keep for you): kept while your account exists. Revoking GSC PAP's access at Google stops new data from being added but does not delete the archive, so your history is still there if you reconnect. Deleting your account deletes it within 30 days. You can ask for earlier deletion of specific properties or date ranges by emailing support. - **Usage log:** 90 days. - **Email log:** kept while your account exists, so we do not send the same email twice. - **Audit log:** 5 years, for security. It never contains Search Console or Analytics data. - **Server logs:** at most 30 days. - **Aggregate statistics** that do not identify any account (such as daily tool-call counts) may be kept for the life of the Service. Signing in again within 30 days of deleting your account restores it, which is why deletion completes after that window rather than at once. ## 7\. Your rights Under GDPR, KVKK (Law No. 6698), and similar regulations you have the right to: - Access the data we hold about you - Correct inaccurate data - Delete your account and associated data - Receive a portable export of your data - Object to processing - Withdraw consent (revoke OAuth) - Lodge a complaint with your local data protection authority Most of these are available self-service from your [account dashboard](https://app.gscpap.com/account): - **Delete account:** [Security](https://app.gscpap.com/account/profile) → Delete account - **Revoke at Google's side:** [myaccount.google.com/permissions](https://myaccount.google.com/permissions) For data export or any other request, email [support@gscpap.com](mailto:support@gscpap.com). We respond within 30 days. ## 8\. Security - OAuth refresh tokens are AES-256-GCM encrypted at rest - Bearer tokens are stored only as SHA-256 hashes - HTTPS-only in production - OAuth flows use PKCE (S256) per OAuth 2.1 - State binding (request fingerprint + HttpOnly nonce cookie) - Per-user rate limiting on MCP requests We do not offer end-to-end encryption, where even we could not read your data. The archive, the background sync that keeps it current, and support all need the server to read it. If zero-knowledge storage is a hard requirement for you, this product is not the right fit. ## 9\. International transfers The Service runs on servers in the European Union, rented from Contabo GmbH. Google and Cloudflare process data in the United States and on their global networks; both take part in the EU-U.S. Data Privacy Framework. By using the Service you acknowledge that your data is processed in these places for the purposes in §3. ## 10\. Changes to this policy We publish each new version here with its effective date and email active users at least 14 days before a material change takes effect. A change that would use your data in a new way also asks for your consent first (§3.3). ## 11\. Contact Questions, requests, or complaints: [support@gscpap.com](mailto:support@gscpap.com). Operator: **GSC PAP** (Personal project (independent operator)). See also the [Terms of Use](https://gscpap.com/terms) and the [KVKK notice](https://gscpap.com/kvkk).