Privacy Policy

Who we are

GSC Aggregator (the "Service") is an internal operations tool operated by Anton Maiatsky at growica.com. It is used by a single team to manage Google Search Console properties at scale. There is no public sign-up.

What data we collect

When you authorize the Service via Google OAuth, we receive and store the following:

• Your Google account email address (used as the identifier for the connection)
• An OAuth refresh token (used to make Search Console API requests on your behalf)
• Search Console property URLs, performance metrics (clicks, impressions, CTR, position), top queries and top pages — only for properties you have access to in GSC

We do not request, collect or store: Gmail content, contacts, Calendar, Drive files, profile photo, YouTube data, or any other personal information beyond the email address.

How we use the data

The data is used solely to aggregate Search Console performance across connected accounts, add new GSC properties, verify ownership, and run URL Inspection — all on your behalf and within Google's published Search Console API. We do not sell, share, or use the data for advertising or any unrelated purpose.

How we store the data

Refresh tokens are encrypted at rest using Fernet symmetric encryption (AES-128 in CBC mode with HMAC). The encryption key is stored as an environment variable separate from the database. Performance metrics are stored in a PostgreSQL database hosted on Railway. All traffic is HTTPS-only.

How long we keep it

Refresh tokens persist until you revoke them (see "Your rights" below) or you delete the connection from the tool. Performance data persists indefinitely so we can show historical trends, unless you ask us to delete it.

Your rights

• Revoke access at any time via myaccount.google.com/permissions. Once revoked, the refresh token in our database becomes unusable and is automatically marked as needing re-authorization.
• Request deletion of your stored data by emailing the operator (see Contact below). We will delete the refresh token, all performance data, and the connection record within 7 days.
• Request a copy of the data we have stored about your Google account.

Limited Use disclosure (Google API Services User Data Policy)

Use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Operator: Anton Maiatsky · anton.maiatsky@growica.com