Privacy Policy
Last updated 5 September 2026. Search Console MCP is a personal project operated by Namit Jain, Kolkata, West Bengal, India — namit2111@gmail.com.
What is collected
- Google account basics. Your name, email address, profile picture and Google account ID, used to identify your account.
- A Google refresh token. The credential that allows Search Console data to be read on your behalf. Encrypted with AES-256-GCM before it is stored.
- Bing Webmaster Tools credentials. Only if you connect Bing. Also encrypted before storage.
- Access tokens issued to your AI assistant. Stored only as irreversible SHA-256 hashes, never in a form that can be replayed.
What is not done
- Your Search Console performance data is not stored. It is fetched when you ask a question, held in memory to answer it, and cached for at most ten minutes.
- Your data is never sold, rented or shared with third parties.
- Your data is never used to train machine learning models.
- Nothing is written to your website, and no Search Console setting is changed, unless you explicitly ask for a sitemap or URL to be submitted.
Google API Services User Data Policy
Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Permissions requested, and why
| Scope | Why it is needed |
|---|---|
| openid, email, profile | To identify your account and show who is signed in. |
| webmasters | To read your Search Console properties, performance data, URL index status and sitemaps — and, only when you explicitly ask, to submit a sitemap or notify Google of a URL. |
Where the data is held
The application runs on Vercel and the database is hosted by Neon, both in the United States. Both encrypt data in transit and at rest, in addition to the encryption applied to your credentials before they are stored.
How long it is kept, and how to delete it
Credentials are kept until you disconnect or ask for deletion. To remove everything: revoke access at myaccount.google.com/permissions and email namit2111@gmail.com. Your record is erased within 30 days. Revoking access in Google immediately stops any further data being read, whether or not you send an email.
Your rights
You can ask for access to, correction of, or deletion of your personal data at any time at namit2111@gmail.com. If you are in the EEA or UK, the legal basis for this processing is performance of the agreement between you and this service. If you are in India, this notice is provided under the Digital Personal Data Protection Act, 2023.
Children
This service is intended for people who manage websites and is not directed at children under 13. No data is knowingly collected from them.
Changes
If this policy changes, the date at the top of this page changes with it. Material changes will be described here rather than made silently.
Contact
Namit Jain, Kolkata, West Bengal, India
namit2111@gmail.com