Search Console for Google Privacy Policy

This policy describes how m23n (“we,” “us”; listed on the App Store as M23N) handles information when you use Search Console for Google, our native iOS app (Apple App Store) for working with Google Search Console: your sites and properties, search performance data, sitemaps, URL Inspection and PageSpeed Insights results. Search Console for Google is an independent product and is not affiliated with, endorsed by or sponsored by Google LLC. By using the app you acknowledge the then-current version of this policy.

Your data stays yours: Search Console for Google reads your Search Console data directly from Google’s APIs on your device and shows it to you. We do not operate a server that receives or stores your Google user data, and we never sell or share it with advertisers or anyone else.

You can delete your data at any time from the app (Settings → Delete account & data) or by e-mail (see section 5).

1. Who we are

Search Console for Google is developed by m23n (M23N). For privacy requests and questions, contact us at support@m23n.com.

2. Categories of information

The list below describes categories of information that may be involved depending on which features you use. Not all categories apply to every user; the app also offers a demo mode with sample data that involves none of your Google data. The app has no separate app account or password: the only sign-in is with your own Google account.

2.1 Google sign-in & Search Console data

To show your properties, the app asks you to sign in with Google using OAuth 2.0 with PKCE and requests the following scopes:

• “View and manage Search Console data for your verified sites” (https://www.googleapis.com/auth/webmasters) – to list your Search Console sites and properties, read search analytics performance data (clicks, impressions, CTR, average position by query, page, country, device, search appearance and date), list sitemaps and submit or delete sitemaps, run URL Inspection, and add or remove properties when you choose to.
• Basic profile (openid, email, profile) – your name, e-mail address and profile picture, used only to label the connected account in the app.

With your consent the app retrieves from the Google Search Console APIs: the list of sites and properties you can access and your permission level for each; search analytics performance data for the date ranges and filters you select; your submitted sitemaps and their status; and URL Inspection results (index status, coverage, crawl, canonical, mobile usability and rich results information) for URLs you inspect. This data is fetched over HTTPS directly from Google to your device, kept in memory and in the app’s local cache, and displayed to you. When you submit or delete a sitemap, or add or remove a property, the change is written to your Search Console account through the same APIs.

Tokens: OAuth access and refresh tokens are stored only in the iOS Keychain on your device and are never transmitted to us. You can revoke the app’s access at any time from the app’s settings (signing out or deleting your account and data revokes the tokens with Google) or from your Google Account’s third-party access page (https://myaccount.google.com/permissions).

Limited Use disclosure: Search Console for Google’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data obtained through these scopes is:

• used only to provide and improve the user-facing features described in this policy (viewing and managing your Search Console properties, performance data, sitemaps and URL Inspection results);
• not transferred to third parties, except as necessary to provide those features, to comply with applicable law, or with your explicit consent;
• not used or transferred for serving advertisements, including retargeting, personalised or interest-based advertising;
• not sold, and not provided to data brokers or information resellers;
• not used to determine credit-worthiness or for lending purposes, and not used to build databases or profiles about you;
• not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not use any Google API, including Google Workspace APIs, for that purpose, and we do not transfer Google user data to third parties for that purpose;
• not read by humans, except with your explicit permission for support, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

2.2 PageSpeed Insights

When you run a PageSpeed test, the app sends the URL you entered to Google’s PageSpeed Insights API and displays the returned performance scores, Core Web Vitals and recommendations. The request goes directly from your device to Google; we do not receive the URL or the results.

2.3 On-device AI insights

On devices that support Apple’s on-device language models (Apple Foundation Models), the app can summarise your performance data and suggest insights. This processing happens entirely on your device; your Search Console data is not sent to us or to any cloud AI service for this purpose, and it is not used to train any model.

2.4 Data stored on your device

Search Console data is cached on your device so the app opens quickly and works offline, including in an App Group container shared only with the app’s own home-screen widgets so they can show your latest numbers. Your watchlists (for example tracked queries or pages), preferences and settings are also stored only on the device. This data is not uploaded to any server we operate.

2.5 Anonymous identifier & analytics

We use Mixpanel to understand how the app is used. On first launch the app generates a random anonymous device identifier that is used as your analytics user id; it is not derived from your Apple ID, Google account, advertising identifier or hardware serial number. Mixpanel collects product usage events (for example which screens are opened, whether a feature was used or a purchase completed), coarse device and app information (model, OS version, app version, language, country derived from IP address by Mixpanel) and that anonymous identifier. Analytics events never contain your e-mail address, site URLs, queries, performance figures or any other content of your Google data. We do not use the advertising identifier (IDFA) and do not track you across other companies’ apps or websites.

2.6 Purchases & subscriptions

Search Console for Google offers the auto-renewing Search Console for Google Pro subscription billed through Apple In-App Purchase. Payments are processed by Apple under its policies; we never receive your payment card details. Subscription status is managed by RevenueCat, which receives the App Store purchase receipt, the products you bought, purchase and renewal dates, an anonymous app user id and basic device information (such as platform, OS and app version, and country/currency from the store), so the app can tell which plan is active. RevenueCat does not receive your Google data or e-mail address.

2.7 Support communications

If you contact us by e-mail, we receive the content of your message and the address you use. We use this information only to respond to you.

3. How we use information

• Show your Search Console properties, performance data, sitemaps and URL Inspection results
• Apply the sitemap and property changes you make in the app
• Run PageSpeed tests for URLs you enter
• Generate on-device insights and power home-screen widgets
• Validate your subscription
• Measure usage and improve the product
• Comply with law and respond to lawful requests

4. Sharing, transfer & disclosure

Your Search Console data is exchanged only between your device and Google. The parties that process information from the app on our behalf or under their own terms are:

• Google LLC – the Search Console API, PageSpeed Insights API and OAuth endpoints that the app talks to on your behalf, under your own Google terms.
• Apple Inc. – App Store purchases and on-device AI processing, under Apple’s policies.
• RevenueCat, Inc. – subscription status for App Store purchases.
• Mixpanel, Inc. – usage analytics keyed by the anonymous identifier, never containing your Google data or e-mail address.
• Authorities – only where required by applicable law or a valid legal request.

We do not show ads, do not sell your information and do not share it with advertisers, data brokers or any other third party. If m23n is ever involved in a merger or acquisition, Google user data will continue to be handled in accordance with this policy and the Limited Use requirements, and you will be notified before any change takes effect.

5. Retention & deletion

Google user data (Search Console data and your basic profile) is held only on your device, in memory, in the app’s local cache and in the widget App Group container, and is removed when you sign out, delete your account and data in the app, or delete the app. Cached data is refreshed from Google as you use the app. You can revoke the app’s access from your Google Account’s third-party access page at any time, after which the app can no longer retrieve any data. Watchlists and settings live only on your device. Analytics data is retained by Mixpanel according to our project settings (no longer than five years) and is not linked to your name, e-mail or Google account. Subscription records are kept by Apple and RevenueCat as required for billing, tax and legal purposes.

In the app, Settings → Delete account & data revokes your Google tokens with Google, removes them from the Keychain, resets your analytics and subscription identity and wipes all data stored by the app on the device, including the widget cache. To have your analytics history deleted, or to exercise access, correction or deletion rights without the app, contact support@m23n.com. We respond within 30 days.

6. Security

All traffic between the app and Google, RevenueCat and Mixpanel uses HTTPS (TLS). OAuth tokens are stored in the iOS Keychain, which is encrypted by the operating system and protected by your device passcode or biometrics, and Google sign-in uses the system web authentication session with PKCE. The app never sees your Google password. Because Google user data is not copied to any server we operate, there is no server-side database of your Search Console data to be breached. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Children

Search Console for Google is a professional tool for website owners and is not directed to children under 16. We do not knowingly collect information from children.

8. Changes

We may update this policy as Search Console for Google evolves. We will post the current version on this page and may provide additional notice for material changes (for example in the app).

9. Related policies

Our website and WristChat (Slack) are covered by a separate policy: Privacy Policy (WristChat & m23n.com). Terms for this app: Search Console for Google Terms of Use.