Search Console Operator · Proof & State
Privacy policy
How Search Console Operator handles information, connections and your choices.
Who operates this product
Search Console Operator is operated by AYOBAMI JOHN HAASTRUP, a United Kingdom sole trader trading as Proof & State ("we", "us"). This notice explains the public Search Console Operator pages and the product's Google connection and supported hosted features. For questions or requests about this product's data, contact woeinvests@gmail.com. Do not include passwords, client secrets, access tokens or refresh tokens in your message.
The main Proof & State website has its own privacy notice. A copy of the software that you run independently on your own machine is under your control; its local files and any third-party clients you choose are not automatically copied into our hosted service.
Current availability and visiting these pages
Hosted access is still being prepared and is not open for public registration. Reading these information pages does not connect a Google account or retrieve Search Console data. The sections below explain how enabled product features handle data when an authorised account uses them.
These static pages do not include advertising or analytics scripts and do not set their own application cookies. Cloudflare serves and protects the pages and may process technical request information, such as IP address, browser information and security events. Protected account routes use Cloudflare Access authentication when enabled; Access uses essential authentication and security cookies. Google processes information on its own sign-in and consent pages. Their processing is also described in Cloudflare's privacy policy and Google's privacy policy.
Information the product processes
When you deliberately connect an enrolled Google account, the product requests:
- Google identity: your unique Google account identifier, email address and verified-email status, to confirm that the grant belongs to the account enrolled for the service.
- Read-only Search Console information: property identifiers and access information; requested performance data such as dates, search queries, page URLs, country or device dimensions, clicks, impressions, click-through rate and average position. Available information depends on your property permissions, the requested report and Google's API limits.
- Connection credentials: the OAuth client information and refresh grant needed to retrieve authorised data without asking you to sign in for every collection. Access tokens are used while making Google requests.
- Saved product records: collection settings and schedules, retained observations and report snapshots, configuration revisions, and alert settings, evaluations and delivery records when those features are enabled.
- Service and security records: request identifiers, operation names, timestamps, outcomes, data digests, connection-attempt records and, if enabled, MCP client-session records. The service request ledger stores a digest rather than the raw request body.
- Correspondence: your email address, message and any information you choose to send when requesting support or help with your data.
The hosted Google connection requests exactly openid, https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/webmasters.readonly. It does not request access to Gmail messages, Drive files or Google Analytics. The software has other separately configured local integrations; they are not enabled by this hosted grant.
Why we use this information
We use the information to authenticate the enrolled account, obtain the Search Console data requested for visible product features, produce reports, preserve reproducible history, execute authorised collection settings, provide explicitly configured alerts, and maintain service security and reliable operation. We use correspondence to respond to the request and necessary follow-up.
Our use and transfer of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising, or use it to train general-purpose or non-personalised AI or machine-learning models. New uses of Google data that differ from the disclosed purposes require an updated notice and any necessary further consent.
Our legal bases
We rely on our legitimate interests in operating and protecting these pages, administering authorised access, providing requested analysis for authorised sites and responding to enquiries, while considering the rights and interests of the people concerned. Where we agree to provide a hosted service to you, we rely on our contract with you for the processing of your personal information necessary to deliver that service, including steps you request before entering it. Where an optional use relies on consent, you can withdraw that consent at any time. We also process information where necessary to meet applicable legal obligations.
Your Google authorisation controls the Google data the product can access. It does not permit unrelated uses of that data. Providing connection information is optional, but we cannot connect your account or retrieve its Search Console data without the required identity information and authorisation.
Storage and access
Enabled hosted features process and store information using Cloudflare. Stored Google connection credentials are encrypted and bound to the authorised account. Reports and history are protected by authentication and account-specific access controls.
Access is restricted to the enrolled account and any separately authorised client or recipient within the permissions granted to it. Operational access to Google data is limited to what is needed for the disclosed service and the applicable Google policy, including permitted security, support with your agreement, and legal purposes. No system can guarantee absolute security.
The software can also retain local snapshots or operator-created recovery exports. Such copies may contain report or configuration data. Collection recovery exports exclude the usable Google grant. A local export or a copy received by another client is not automatically removed when the hosted connection changes.
Providers and sharing you choose
Google provides account authorisation and Search Console data. Cloudflare provides hosting, access protection and storage for hosted features.
If you explicitly authorise a supported MCP client, it can receive the tool results allowed by its granted scope. Those results can include retained Search Console information. The product does not give that client your Google refresh token or client secret. The client may be an AI assistant, and its processing and any copies it retains depend on that provider's settings and terms. Authorising a client is separate from connecting Google; it is not permission for us to use your data for general-purpose model training.
If email alerts are enabled and you have approved a configured recipient, selected alert information is delivered through Cloudflare's email service and the recipient's email provider. The application does not accept an arbitrary recipient address from a report request. Operator exports and separately enabled report-sharing features can create additional copies or grants; those are not enabled merely by visiting these pages or connecting Google.
We do not publish your Search Console reports automatically. Any disclosures needed for security or applicable legal obligations remain subject to the relevant restrictions on Google data.
International processing
Cloudflare and Google operate internationally, so information may be processed outside the United Kingdom. Cloudflare's Data Processing Addendum describes its transfer safeguards, including the UK Extension to the EU–US Data Privacy Framework for eligible transfers and standard contractual clauses with the UK Addendum where required. Google describes its own arrangements in its data transfer information. Contact us for information about the safeguards relevant to this service.
Retention and your controls
We decide how long to retain information by considering whether it is still needed for the requested report history, recovery, security, support or an applicable legal obligation. Information that is no longer needed is removed or anonymised through an appropriate operator process. The application does not currently apply a fixed automatic deletion period. Some operations retain limited identifiers or audit records, and copies already exported or sent to another recipient require separate handling. Token expiry ends that token's validity; it does not delete retained reports or account records.
The available controls have different effects:
- Disconnect the stored Google connection: the account connection control removes this product's stored Google grant and stops it from being used for new collection. It does not delete retained reports, revoke the grant at Google, revoke MCP sessions or disconnect other applications.
- Revoke access at Google: manage the connection at Google Account connections. This affects future Google access; it does not erase information already retained by the product or another recipient.
- Revoke an MCP session: use the separate supported client-session control. Revocation stops subsequent use of that session; it does not recall results already received by the client.
- Unsubscribe from alerts: use the applicable alert control or supplied unsubscribe link when available. This stops the relevant future delivery; prior messages and delivery records can remain.
To request information about, correction of, or deletion of data held by this product, email woeinvests@gmail.com. We may need to verify that the request concerns your account. Requests are handled by the operator; the product does not currently provide an automated delete-all-account-data button. We will explain the records and copies affected, the actions available, and any information that must be retained.
Your rights and complaints
You can ask for access to your personal information and correction of inaccurate or incomplete information. Depending on the circumstances, you can also ask for deletion, restriction of use or a portable copy. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Your right to object: you can object to processing based on legitimate interests by contacting woeinvests@gmail.com and explaining your circumstances.
Contact us with a privacy request or concern. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
Changes and contact
We will update this notice when the product's data practices change and show the updated date. Changes to Google data use that require further disclosure or consent will be presented before that new use. Contact woeinvests@gmail.com with questions about this notice.