Last updated: October 19, 2026
GSC MCP (“the App”) is a private tool operated by [YOUR NAME / BUSINESS NAME] (“we,” “us”). It connects Google Search Console accounts to AI assistants so we can analyze search performance for websites we own or manage. This policy explains what data the App accesses and how it is handled.
Who can use the App
The App is not a public service. Only Google accounts belonging to us, or accounts whose owners have explicitly authorized us, are connected to it.
Data we access
When a Google account is connected, the App asks for one permission: read-only access to Google Search Console (https://www.googleapis.com/auth/webmasters.readonly). With this permission the App can read:
- The list of Search Console properties the account can access, and the permission level for each
- Search performance data: queries, pages, clicks, impressions, click-through rate, average position, country, and device
- URL inspection results: index status, crawl details, and rich result status
- Sitemap information
The App cannot add, change, or delete anything in Search Console. It does not request access to Gmail, Drive, Calendar, contacts, or any other Google service.
How we use the data
Search Console data is used only to provide the App’s function: answering questions about search performance for the connected websites, on request from an AI assistant we use (for example Claude, ChatGPT, Cursor, or Codex). Data is fetched from Google when a request is made and returned to the assistant that asked for it.
We do not:
- Sell, rent, or trade Google user data
- Use Google user data for advertising
- Use Google user data to train generalized AI or machine-learning models
- Share Google user data with anyone except as needed to provide the App’s function, to comply with the law, or with the account owner’s consent
Storage and security
- Login credentials: For each connected account, the App stores an OAuth refresh token as an encrypted secret on our hosting provider (Railway). Tokens are never committed to source code.
- Search Console data: The App does not keep a database of Search Console data. Data passes through the App at the time of a request. The list of properties is cached in memory for up to 10 minutes so each request reaches the right account.
- Access control: The App’s endpoint is served over HTTPS and requires a secret access token. Requests without it are rejected.
- AI assistants: Data returned to an AI assistant is then handled under that assistant provider’s own privacy policy.
Retention and deletion
A refresh token is kept until the account is disconnected. You can revoke the App’s access at any time at myaccount.google.com/permissions: find “GSC MCP” and select Remove access. Once access is revoked, the token stops working and we delete it from our hosting environment. You can also contact us to ask for deletion.
Google API Services User Data Policy
The App’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Children
The App is not directed to children under 13 and does not knowingly collect their data.
Changes
If we change this policy, we will update the “Last updated” date above.