Data and permissions
Privacy Policy
What this application is intended to access, and what it does not do today.
Last updated: 3 November 2026
1. Scope and operator
Site Ops Read-only Collector is a private utility operated by its individual website owner for reporting on websites they are authorized to manage. This policy covers the planned collector and this public information website. It does not describe a public registration service.
No account authorization has been completed and no data collection API is connected. The collection practices below describe the permitted design, not an assertion that collection is already running.
2. Information accessed
With the owner’s consent, the planned initial Google Search Console integration may read page-level search performance, impressions, clicks, submitted sitemap data and supported indexed-URL information. Search queries are a possible future category; the initial collection plan does not retrieve or store them.
The planned initial AdSense integration may read account and site information, including available site review states. Earnings and performance reports are a future category and are not part of initial collection. The separate Bing integration is intended to read search performance, site information and supported sitemap information; it is not connected.
The application will not request Gmail messages, Google Drive files or unrelated personal information. Provider account and site identifiers may be needed to select authorized resources. Only explicitly selected sites may be retained in reports; authorization alone does not enforce that site selection.
3. OAuth permissions
These permissions are for reporting. They do not authorize this utility to edit websites, publish content, submit AdSense review applications or request Google Security Reviews. Before any additional data category is accessed, the disclosures and collection implementation must be reviewed and any necessary consent obtained.
4. Use and storage
Collected information is intended only for the owner’s private website operations reports and analysis. It will not be sold, provided to advertisers, used to build advertising profiles, used to train general-purpose AI models, or sent to external AI services.
The storage design uses the owner-controlled Ubuntu server. OAuth credentials must remain in private configuration storage outside all public website directories and release archives. This information website contains no credentials and cannot receive an OAuth callback or account data.
The collector’s storage controls have not yet been implemented or verified. No claim is made that application-level encryption, a managed key service, automatic deletion or a separate protected service identity is in place.
5. Sharing and provider communication
The proposed collector communicates with Google and Microsoft authorization and API endpoints to obtain access and retrieve the permitted information. Tokens must be sent only to the appropriate provider endpoints and must never be exposed in public pages or logs.
No other data recipient or analytics intermediary is part of this design. Any future use or transfer of information received from Google APIs must comply with the Google API Services User Data Policy, including its Limited Use requirements.
6. Retention and deletion
No collected API dataset exists in this application yet. A retention period, deletion command and automatic cleanup mechanism have not been implemented. Before collection begins, the operator must set and disclose the actual retention period, where reports and backups reside, and a tested way to delete the selected data and local authorization material.
Revoking provider access prevents further authorized collection but does not erase previously downloaded reports or backups. Those copies must be removed separately by the operator, including any copies they have exported. This site does not currently offer a deletion form or automated deletion service.
7. Security
The public pages have no application scripts, forms, external fonts or advertising integrations. They do not request a password or account credentials. The proposed collector requires private file access controls, restricted credential storage, verified HTTPS connections and redaction of secrets in logs. Those collector controls must be verified before activation; they are not guarantees of an already operating system.
No system can promise absolute security. Do not send credentials or private reports through this website.
8. Revoking access
The owner can remove Google access in Google Account third-party connections. Microsoft account app permissions can be reviewed in Microsoft account permissions; Bing authorization should also be reviewed through Bing Webmaster Tools where applicable to the account.
Once authorization is revoked, the collector must stop future collection from that source. It must not bypass revocation or switch to another account. Revocation does not delete existing local copies; the separate deletion steps described above are still required.
9. This website and third-party policies
These pages contain no application cookies, tracking scripts or analytics code. Following an external link contacts that provider. When hosted, the hosting and network providers may process ordinary request information such as IP address, requested URL and browser headers to deliver and protect the site. No specific hosting-log retention period has been verified here.
Relevant policies: Google Privacy Policy, Microsoft Privacy Statement, and Cloudflare Privacy Policy. Provider terms and access policies apply independently.
10. Contact
For general enquiries, contact [email protected].
For privacy questions and data requests, contact [email protected].