How WebValet uses your Google data
WebValet connects to Google in two separate steps with two separate consent screens: a basic sign-in, and an optional read-only connection to Search Console and Google Analytics. This page explains both in detail so you know what you are agreeing to.
Limited Use disclosure: WebValet's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
On this page
| Scope | What it gives us | What we do with it |
|---|---|---|
| openid | A stable Google account ID | Identify your account on later sign-ins |
| Your email address | Account identity, Monday report, alerts, billing receipts | |
| profile | Your name and profile picture | Show your name in the dashboard |
Sign-in is handled by WebValet directly with Google. No other scope is requested at this step and there is no access to your Google services.
During onboarding, or later from Settings → Google, you can connect one or both products. Each is explained on screen before the Google consent page opens. You can connect just one.
| Scope | Product | Access level |
|---|---|---|
| https://www.googleapis.com/auth/webmasters.readonly | Google Search Console | Read-only |
| https://www.googleapis.com/auth/analytics.readonly | Google Analytics (GA4) | Read-only |
API methods we call
| API | Method | Why |
|---|---|---|
| Search Console API | sites.list | Show the properties you can choose from |
| Search Console API | searchanalytics.query | Clicks, impressions, CTR and average position by date, query, page, country and device, for the property you chose |
| Search Console API | sitemaps.list | Check whether your sitemap is submitted and when it was last read |
| Search Console API | urlInspection.index.inspect | Confirm whether a page we fixed is indexed (limited to the pages in your plan) |
| Analytics Admin API | accountSummaries.list | Show the GA4 properties you can choose from |
| Analytics Data API | properties.runReport | Sessions, users, engagement and conversions by date, landing page and source, for the property you chose |
What you see
- Real clicks and impressions next to each tracked keyword and page in the Found on Google module.
- The Impact log: for every fix, the 28 days of Search Console data before and after, so you can see whether it worked.
- Traffic charts in Overview and the Monday report.
- Ask WebValet answers that quote your own numbers (for example "why did traffic drop last week?").
What we never do
- Write, change or delete anything in Search Console or Analytics. The scopes we request do not allow it.
- Read Gmail, Drive, Calendar, Contacts, Ads, YouTube or any other Google product.
- Access properties you did not choose. We store only the property IDs you selected.
- Sell, rent or share your Google data with anyone, show it in ads, or use it to train AI models.
- Let a human read it, except with your permission for support, for security, or as required by law.
- The OAuth refresh token is encrypted with AES-256-GCM before it is stored; the key is held outside the database as a Cloudflare secret.
- Access tokens live in memory only for the duration of a request.
- Search and traffic data we read is stored as daily aggregates for your properties so charts and the Impact log can show history. We keep it while the site is in your account and delete it 90 days after you remove the site or close the account.
- Everything is stored on Cloudflare (D1 database, KV and R2), with encryption in transit and at rest.
- In WebValet: Settings → Google → Disconnect. Our stored tokens are deleted immediately and the Impact log stops updating.
- In Google: open myaccount.google.com/permissions, find WebValet and remove access. Our next API call fails and we delete the tokens automatically.
- Delete your account from Settings to remove everything.
The read-only Search Console and Analytics scopes are classified by Google as sensitive and require app verification. WebValet has submitted for verification. Until it completes, the connect step may show Google's "unverified app" warning and is limited to 100 users; everything else in WebValet works without connecting Google.
Email privacy@webvalet.app. This page is part of our Privacy policy.