Privacy Policy
SEO OS GSC — last updated 26 October 2026.
Who this policy covers
SEO OS GSC ("the application") is an owner-operated tool at a proof stage, run by its operator, reachable at connectsalmanofficial@gmail.com. This policy describes what Google user data the application accesses, how that data is used, where it is stored, how long it is kept, and who it is shared with.
Google data the application accesses
The application requests a single Google OAuth scope:
https://www.googleapis.com/auth/webmasters.readonly
Google grants that scope at the account level. It permits read-only access to Search Console data for any property the authorising Google account can access — which may include properties that account did not itself verify but has been given access to. The application's own configuration, not the scope, is what narrows this.
What the application is designed to read:
- the list of Search Console properties available to the signed-in account, so a property can be selected;
- search performance metrics for the configured property — search queries, page URLs, clicks, impressions, click-through rate and average position, broken down by date and by the other dimensions Search Console exposes.
At this proof stage the only configured property is
https://seoos-proof.pages.dev/, which the operator controls.
No other Google scope is requested, so the application has no access to email, files, contacts, calendar, advertising or analytics products.
How the data is used
Search Console data is used only to produce search-performance reporting for the property it was read from. The application is read-only: it does not write to, modify or delete anything in Search Console. No production access token has been issued yet, so no Search Console data has been retrieved through the application to date — this section describes the only use the application is built for.
Google user data is not used for advertising, is not sold, and is not used to train machine-learning models.
Where credentials and data are stored
OAuth client credentials and any access or refresh tokens are kept outside the application's source-code repository, on infrastructure the operator controls. This section states separately what is in place today and what is planned, so the two are not confused.
In place today
- The application runs on the operator's own Windows computer.
- Credentials are stored on that computer, outside the source-code repository.
- No production access token has been issued yet, so no Search Console data has been retrieved through this application.
- The three public pages you are reading are static files hosted on Cloudflare Pages. They contain no Search Console data and no credentials.
Planned, not yet in place
- The operator intends to move credential storage and report generation to a private virtual server hosted by OVH, so that reporting can run unattended.
- That change has not happened. If and when it does, OVH will hold the stored credentials and retrieved Search Console data as the operator's hosting provider, and this policy will be updated to say so before the change takes effect.
How long data is kept
Retrieved Search Console data and stored tokens are kept until the operator deletes them, or until you ask for deletion as described below. There is no automated deletion schedule, and this policy does not claim one.
Who the data is shared with
Search Console data comes from Google. At this proof stage it is used by the operator alone, for reporting on a property the operator controls.
- Google, as the source of the data.
- Cloudflare, as the host of these three public pages — which carry no Search Console data.
- OVH, if and when the planned private server described above is actually put in place, as the operator's hosting provider.
Beyond that, Search Console data is not sent to any other third-party service, API or AI service, and is not transferred to anyone for their own independent purposes. If the application's scope ever broadens past this proof stage — for example to report on properties belonging to someone else — this policy will be updated before that happens, so that the people whose data is involved can see who holds it.
Security
Credentials are kept outside the application's source-code repository, on infrastructure the operator controls, and only the operator has access to them. The application requests a read-only scope, so a compromised token could not change anything in your Search Console account.
This policy makes no claim of encryption, formal access controls or security certification, because none is in place. It is an owner-operated tool at a proof stage, and is described as one.
Withdrawing access, and requesting deletion
Withdrawing access. You can withdraw the application's access to your Google account at any time at myaccount.google.com/permissions. Google lists each authorisation under the name shown on the consent screen you approved. For this application that name is expected to be SEO OS GSC, but Google controls how an app's name is displayed and may show a different one until the app's branding has been verified, so check the requested scope shown alongside a grant before removing it.
What withdrawal covers. Google records the authorisation against the
Google Cloud project behind the application — seo-os-gsc-512719 — rather than
against a single OAuth client. Removing that grant withdraws the authorisations held by
that project. This application is currently the only thing in that project, but if others
are added to it later, the same removal would cover those too. Grants belonging to any
other Google Cloud project you have authorised are listed and removed separately and are
not affected. After removal, the application can no longer request new Search Console
data for your account.
Deleting data. Withdrawing access does not erase Search Console data that was already retrieved and saved. To have that deleted, email connectsalmanofficial@gmail.com and the operator will delete it. The two actions are separate: do both if you want both.
Google API Services User Data Policy
The application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Children
The application is not directed at children and is not intended for use by anyone under 13.
Changes to this policy
If this policy changes, the updated version is posted at this address with a new "last updated" date.