PRIVACY

Privacy notice

Last updated: October 12, 2026

Controller: the operator of this deployment. Contact: the contact address provided by the deployment operator.

This notice explains how GSCmate at https://gscmate.com handles account and Search Console information.

Information processed

• Google account identifier, email address, and profile name for sign-in and account support.
• Encrypted Google OAuth refresh tokens and short-lived access tokens so the service can request Search Console data for you.
• Search Console property URLs and read-only performance data returned for a request. Search Analytics, sitemap, and URL Inspection responses are returned live and are not retained by this app.
• Your favorites, insight statuses, MCP access-token hashes, and basic token-use timestamps.
• Basic request and error metadata needed to operate and protect the service. OAuth tokens and Search Console rows are not written to application logs.

How the information is used

The service uses this information to sign you in, request and show data for properties available to your Google account, and provide MCP tools to clients for which you create a token. Search Console API responses are not saved by this app. GSCmate does not modify Search Console settings, submit sitemaps, sell account data, or use Google user data for advertising or general-purpose AI model training.

Google access

Google sign-in requests identity details and the read-only Search Console scope. Google controls the authorization process and its own handling of data. You can revoke this application's Google access in your Google Account security settings. GSCmate's use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

Sharing and connected MCP clients

Google and the service providers listed below process information as needed to operate sign-in, Search Console queries, hosting, storage, and security. When you create an MCP token, tools can return the data available to that Google account to the MCP client where you configure the token. That client and its provider may process the data under their own terms and settings. Create tokens only for clients you trust, and revoke them when no longer needed.

Storage, retention, and deletion

OAuth credentials are encrypted in the service database. Session identifiers and MCP credentials are stored as one-way hashes. Browser sessions expire after 30 days. Search Console API responses are held only while a request is being processed and are not retained as an analytics archive. Use “Delete my GSCmate data” in MCP access to remove your profile, sessions, connected account tokens, preferences, insight statuses, and MCP tokens. Deletion also attempts to revoke the stored Google token. You can separately revoke Google access from your Google Account.

Service providers and transfers

Hosting, database, and logging providers: Google and the providers selected by the deployment operator. Google also processes data through its identity and Search Console APIs.

Processing locations and transfer safeguards: the regions selected by the deployment operator. Provider terms and privacy notices describe their own security and retention practices.

Your choices and contact

You can sign out, revoke MCP tokens, revoke Google access in your Google Account, or delete your GSCmate account data. For access, correction, deletion, or privacy questions, contact the contact address provided by the deployment operator.

Changes

The operator may update this notice when the service or its providers change. The updated date above indicates the latest published version.