← Back to TrafficGap

Privacy Policy

Last updated: 28 May 2026

What TrafficGap is

TrafficGap is a web application that connects to your Google Search Console and Google Analytics accounts to identify which pages on your site are worth improving, and how. It is operated as a personal tool and small commercial product.

What data we access

When you sign in with Google, we request the following permissions:

  • Basic profile — your name and email address, used to identify your account and track usage limits.
  • Google Search Console (read-only) — clicks, impressions, CTR, and average position for URLs on your site over the past 180 days.
  • Google Analytics (read-only) — sessions, bounce rate, and conversions per page over the past 90 days.

All Google access is read-only. We never modify, delete, or write anything to your Search Console or Analytics accounts.

How we use your data

  • Your GSC and GA4 data is fetched in real time when you click Analyze and is used only to generate your priority list. It is not stored on our servers.
  • Your email address is used to track how many page scans you have used in the current month. This count is held in server memory and resets monthly. It is not written to a database.
  • When you scan a page, the URL is sent to Jina Reader to fetch its content, and that content along with your GSC metrics is sent to Anthropic to generate the analysis. See their privacy policies for how they handle data in transit.

What we do not do

  • We do not sell your data to third parties.
  • We do not store your GSC or GA4 data after your session ends.
  • We do not use your data for advertising or tracking.
  • We do not share your data with anyone other than the third-party services listed above (Google, Jina, Anthropic), and only for the purpose of delivering the product.

Cookies and sessions

TrafficGap uses a session cookie to keep you signed in. This cookie is issued by NextAuth.js and contains an encrypted token. No third-party tracking cookies are set.

How we protect your data

  • All communication between your browser and our servers is encrypted in transit using HTTPS/TLS.
  • For ordinary dashboard use, your Google OAuth tokens are never written to a database. They are stored only in an encrypted, server-side session cookie (issued by NextAuth.js) for the duration of your session. The one exception is an AI assistant connection you explicitly approve — see "AI assistant connections (MCP)" below.
  • GSC and GA4 data retrieved from Google APIs is processed in memory and discarded after your request completes. It is never written to disk or a database.
  • Content sent to Anthropic and Jina Reader for analysis is transmitted over HTTPS. We do not retain copies of that content on our servers.

AI assistant connections (MCP)

TrafficGap offers an optional MCP (Model Context Protocol) connector so you can query your traffic data and run page scans directly from Claude or another compatible AI assistant, instead of copying data back and forth manually. This is off unless you explicitly approve it.

  • Connecting requires signing in to TrafficGap and approving a consent screen that states exactly what access is being granted, every time a new assistant connects.
  • Approving a connection persists your Google refresh token, encrypted at rest (AES-256-GCM), so the assistant can fetch your Search Console and GA4 data between conversations without you staying signed in. This is the only circumstance under which we store a Google token in our database rather than only in your browser session.
  • The AI assistant itself never sees your Google credentials — it holds its own TrafficGap-issued access token, which our server uses on your behalf.
  • Page scans run through an MCP connection count against your plan's scan limit and are subject to the same rate limits as scans run from the dashboard.
  • You can revoke any connection at any time from the "Connected AI assistants" panel on your dashboard, which immediately invalidates that assistant's access.

Data retention and deletion

  • GSC and GA4 data — not retained. Data fetched from Google APIs exists only for the duration of a single request and is never stored.
  • OAuth tokens (dashboard sign-in) — held in an encrypted session cookie and automatically expire when the session ends or the cookie reaches its maximum age (30 days). Signing out immediately invalidates the session and clears the token.
  • Google refresh token (AI assistant connections only) — stored encrypted in our database only if you approve an MCP connection, and only for as long as at least one connection is active. Revoking your last connection from the dashboard, or emailing us, removes it.
  • Scan usage counters — stored in our database so plan limits and rate limits are enforced correctly regardless of which server instance handles a request. Monthly counters reset automatically each calendar month.
  • Requesting deletion — to request the removal of any account-associated data, email us at support@trafficgap.net. Revoking Google access (see below) simultaneously prevents any future data from being fetched.

Revoking access

You can revoke TrafficGap's access to your Google account at any time by visiting myaccount.google.com/permissions and removing TrafficGap from the list of connected apps.

Changes to this policy

If we make material changes to how we handle your data, we will update this page and change the date at the top. Continued use of TrafficGap after changes are posted constitutes acceptance of the updated policy.

Contact

Questions about this policy? Email us at support@trafficgap.net.