Privacy & data handling
Version 2026-11-13.1 · Personal-property testing deployment
Systems that handle your data
- Google: supplies Analytics data under your account’s permissions. The OAuth permission is read-only Analytics access; choosing one property in the app does not narrow Google’s OAuth permission scope.
- Cloudflare Workers: runs the backend and processes report requests and report responses before sending them to your browser.
- Cloudflare D1: stores encrypted Google access/refresh tokens, session identifiers and expiry, sign-in verification state, and acceptance version/time. The app does not intentionally persist report tables there.
- Your browser and computer: store app preferences and saved report definitions locally. Downloaded exports remain on your computer until you remove them.
Who can access the connection
The backend decrypts stored tokens to retrieve reports. The app operator administers the Cloudflare deployment and its keys, so token encryption is not a guarantee that the operator cannot access data through the authorization. Cloudflare and Google process data under their applicable service terms and policies. Report data is sent to your browser for display; you control whom you share the screen, reports and exports with.
Each tester signs in with their own Google account and chooses a GA4 property they can access. Google enforces that account’s property permissions. Do not authorize work or client data without the required approval. Organizational data-processing agreements, approved vendors and geographic restrictions must be reviewed separately; this app does not certify compliance with them.
Retention and deletion
- Sessions stop working after seven days. Daily scheduled cleanup normally removes expired connection records within the next cleanup cycle; outages can delay that job.
- Pending sign-in verification states expire after ten minutes and are removed when consumed or by cleanup.
- A short-lived, encrypted consent cookie records the current notice acceptance for up to one hour while sign-in is completed.
- Google-generated background report tasks can remain queryable for up to 72 hours by people who already have read access to the same property.
- Local settings remain until you clear the app’s site data. Exports remain until deleted separately.
- Cloudflare-managed backups and operational logs can persist beyond active-record deletion under the provider’s plan and policies. We cannot promise immediate erasure from those systems or a fixed storage/processing country.
Sharing and support
The reporting backend has no automatic advertising or AI-data-sharing integration. If you share a screenshot or permit support/development inspection, the support people and tools involved may receive that information. Do not share confidential data with unapproved support tools. Links to external Google tools open those services; entering a URL into PageSpeed Insights shares that URL with Google.
Your choices
Use Admin → Disconnect Google to end an active app connection, and use your Google Account’s third-party connections page to revoke the app’s Google permission. Clearing browser data does not revoke Google’s grant or remove downloaded files. You may use the labeled demo without authorizing Google.
Beta disclosure: operator identity/contact details, contractual requirements, retention guarantees and legal review must be finalized before public launch. This page describes the current design; it is not a certification of organizational approval.