Search Analyst privacy and data handling

Search Analyst reads your Google Search Console and Bing Webmaster data only when you ask a question in your AI app, keeps it in memory for at most 10 minutes, and never stores it in a database. It does not use your data for advertising or to train AI models, does not sell it, and people do not read it. Search Analyst's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This policy covers Search Analyst, a service of Tidewell Software (a sole trader based in the United Kingdom; "we"). It adds to the Tidewell Software privacy policy. Contact: [email protected].

What Google data we access, and why

• Scope https://www.googleapis.com/auth/webmasters.readonly ("View Search Console data for your verified sites"): the list of your Search Console properties, search performance data (queries, pages, countries, devices, dates, clicks, impressions, CTR, position) and URL Inspection results. We use it only to answer the questions you ask through the tools listed on the tool reference. It is read-only: we cannot change anything in Search Console.
• Scopes openid and email: your Google account id and email address, to identify your Search Analyst account and match a paid plan.

Bing data is read with the Bing Webmaster API key you save, for the Bing tools only.

How we use it

• Data is fetched only when you call a tool from your AI app (Claude, ChatGPT, Cursor, Claude Code or another MCP client). There is no background collection, crawling or reporting.
• We compute the analysis and return the result to the AI app that asked. That app shows it to you in your conversation and handles it under its provider's terms (for example Anthropic's or OpenAI's); this transfer happens at your request and is the user-facing feature you asked for.
• We do not use Google or Bing data for advertising, retargeting or personalised ads; we do not use it to develop, improve or train AI or machine-learning models (ours or anyone else's); we do not sell it or transfer it to data brokers or information resellers; and we do not use it to determine creditworthiness or for lending.
• No person reads your Google data, unless you ask us to in a support request and agree, where it is needed for security purposes (such as investigating abuse), or to comply with the law.

Limited Use disclosure

Search Analyst's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we store

Search Console and Bing results are not stored. They are held in the Worker's memory for at most 10 minutes so repeated questions in one conversation do not repeat API calls, and are then discarded. Request logs record only the time, tool name, outcome, status code and duration, never your queries, URLs, arguments or results.

Security

• Google refresh tokens and Bing keys are encrypted with AES-256-GCM using a per-account data key, wrapped by a master key held as a Cloudflare Worker secret.
• The service calls only Google's, Bing's and IndexNow's API hosts over HTTPS. The one exception is the IndexNow key file check on your own site, which goes through a filter that refuses private and internal addresses.
• Your AI apps connect with OAuth 2.1 and PKCE; their tokens are stored hashed. Rate limits apply per address and per account.

Who else processes data

• Cloudflare hosts the service (Workers, D1 database, KV storage).
• Google and Microsoft (Bing) provide the data through their APIs; IndexNow participants receive URLs you submit.
• Freemius, our merchant of record, processes payments and invoices for paid plans under its own privacy policy. It does not receive any Search Console or Bing data.

How to revoke access and delete your data

• Revoke Google access: Google Account → Security → Your connections to third-party apps and services → Search Analyst → Delete all connections (or myaccount.google.com/connections). The tools stop working at once.
• Delete your account and data: on your account page, sign in with Google and use Delete everything. This revokes our Google access, signs out every connected AI app, and deletes your account, stored tokens and keys, usage counts and request metadata immediately. Programmatic option: DELETE https://search.tidewellsoftware.com/api/account with your access token or API key.
• Or email [email protected] and we will delete it within 7 days. Licence records for paid plans are kept, unlinked from your account, where accounting law requires.

Retention

Account data is kept until you delete the account or ask us to. Request metadata is kept for 30 days. Support emails are kept for up to 2 years.

Your rights

Under UK GDPR you can ask for access to, correction of or deletion of your personal data, and object to processing: email [email protected]. You can complain to the UK Information Commissioner's Office (ico.org.uk). Search Analyst is not directed at children under 16.

Changes

We will post changes here and, for material changes affecting Google data, ask for consent again before using data in a new way.