Privacy Policy

1. Information we process

GSC MCP processes only information needed to provide its search, analytics, indexing and growth-operation features. Depending on the permissions you choose, this may include:

• Authorization data: Google OAuth access permissions, encrypted refresh tokens, connection status and granted-scope metadata.
• Search Console data: properties, permission levels, search-performance metrics, queries, pages, countries, devices, sitemap metadata and URL Inspection results.
• Google Analytics 4 data: account/property metadata, selected property mappings, aggregate reports, landing-page, traffic, event, ecommerce and related historical metrics.
• Google Tag Manager data: account, container, workspace, tag, trigger and variable configuration required for an explicitly requested GTM operation.
• Merchant Center data: accessible account metadata, product/report information, listing status and bounded report snapshots.
• Workspace and analysis data: topic clusters, content groups, query maps, saved filters, annotations, indexing trackers, SEO issues, migration mappings, feed-audit results and report configuration.
• Operational data: sync status, error summaries, timestamps, issue-state history and service-health information needed to operate and troubleshoot the service.

GSC MCP does not request your Google password, MFA code, payment-card data, government identifier or health information. The current Google OAuth flow does not request OpenID profile or email scopes.

2. How information is used

Information is used to authenticate your connection, execute MCP tools you request, generate reports and analysis, maintain historical comparisons, detect changes, perform scheduled synchronization you enable, protect the service, and troubleshoot failures. GSC MCP does not use connected Google data for advertising and does not sell connected data.

3. Where information is sent

Relevant information may be transmitted to:

• Google APIs when a requested GSC, GA4, GTM or Merchant operation is executed.
• IndexNow only when you explicitly configure and use IndexNow submission.
• Cloudflare as the infrastructure provider for the Worker, D1 database, KV storage and Durable Objects.
• Your MCP client, such as ChatGPT or Codex, when a tool returns the data needed to answer your request.

GSC MCP does not intentionally disclose connected data to unrelated advertisers or data brokers.

4. Storage and security

Google refresh tokens and stored IndexNow keys are encrypted using AES-GCM before being written to the production database. OAuth state is single-use and short-lived. Dashboard sessions are stored server-side and use secure, HttpOnly cookies. The service avoids returning refresh tokens, client secrets or other stored credentials through MCP tools.

5. Retention

• Google OAuth state expires after approximately 10 minutes.
• Dashboard session records expire after approximately 7 days.
• Connection records, encrypted refresh tokens, historical metrics, analysis records and configuration are retained while the connection remains active and while they are needed to provide the requested history and features.
• After a verified deletion request, server-side records associated with that connection are targeted for deletion within 30 days, except records that must be retained for security, legal or abuse-prevention purposes.

Revoking Google authorization prevents future API access but does not by itself guarantee immediate deletion of historical records already stored by GSC MCP.

6. Your controls

You can decline optional GA4 or management permissions, revoke GSC MCP’s Google access from your Google Account, disconnect the plugin in ChatGPT, and request deletion of server-side connection data. For deletion or privacy support, follow the instructions on the Support page.

7. Google API data

GSC MCP’s use and transfer of information received from Google APIs is limited to providing and improving user-facing functionality requested by the connected user. The service is designed to follow the Google API Services User Data Policy, including applicable Limited Use requirements.

8. Children

GSC MCP is a developer and business analytics tool and is not directed to children.

9. Changes to this policy

Material changes will be reflected on this page with an updated effective date. Continued use after a change is subject to the updated policy.

10. Contact

For privacy questions or deletion requests, use the GSC MCP Support page. The public publisher identity is FourTran.