Privacy Policy

Switchboard — read-only Search Console and Analytics reporting. Last updated 25 September 2026.

1. Who this covers

Switchboard is operated by an administrator at Sarver Enterprises ("the operator") for the operator's own websites and those of clients who authorise a connection. It is not a public sign-up service and it does not create accounts for the general public. Questions or requests about this policy can be sent to asarver@sarverenterprises.com.

2. What Switchboard collects and why

Switchboard collects the following, and only the following, when a Google account is connected:

• Google account identity. From the OAuth 2.0 / OpenID Connect openid and email scopes, the account's stable Google subject identifier (sub) — stored as the unique key for the connection — together with the email address, and a display name when Google supplies one. The email is kept as descriptive metadata; the subject identifier is what identifies the account.
• Read-only Search Console access. Using the scope https://www.googleapis.com/auth/webmasters.readonly, Switchboard can read the list of Search Console sites the account can access and query search performance data (allowed dimensions include query, page, country, device and date) for the sites the operator has selected.
• Read-only Google Analytics 4 access. Using the scope https://www.googleapis.com/auth/analytics.readonly, Switchboard can read the Analytics 4 properties the account can access and run traffic reports for the properties the operator has selected.
• OAuth credentials. Google returns an access token and, on consent, a refresh token. These are stored so a report can be fetched without the operator signing in again.
• Connection metadata and operational records. Which account is connected (see above), which Search Console sites and Analytics properties are allowed for that connection, an audit trail of connection events such as the connection being added, renewed or revoked, and ordinary request logs for the private dashboard (time, path, status, duration and source address).

The figures themselves are not kept. Report results are returned from Google when requested and shown to the operator; they are not written into a separate reporting store. What is stored persistently is the connection, the credential, the allow-list of resources and the connection audit trail.

3. What Switchboard does not request or do

• It requests only four scopes: openid, email, the read-only Search Console scope, and the read-only Analytics scope. It does not request the read-write forms of either Google API.
• It requests no broader identity scope (profile or any userinfo.* scope) and no Gmail, Drive, Calendar or other Google data.
• It performs no write, publish, or delete operation against Google data, and it cannot alter a connected account.
• It does not fetch, store, or serve any of your site's visitor-level Analytics data for advertising, profiling, or resale.
• It is still in development. Selecting which sites and properties a connection is allowed to use, and the dashboard view that presents the figures, are not enabled yet: the selection controls stay disabled and the service refuses a caller-supplied site or property id until the provider-verification step exists. Today it completes the Google connection and holds the read-only credential.

4. How data is stored and protected

• Connection records, the encrypted credential, the allow-list of resources and the connection audit trail are held in a local database operated by the operator on privately managed infrastructure. Report figures are not persisted; they are read from Google when requested. The private dashboard is not published on the public internet.
• OAuth access and refresh tokens are encrypted at rest with authenticated symmetric encryption (Fernet: AES-128-CBC with HMAC-SHA256) before they are written to the database. The encryption key is held separately in a file restricted to the operator, not in the database. A value that is not a valid encrypted envelope is refused rather than treated as a token.
• When the operator disconnects a connection in Switchboard, its stored token envelopes (access and refresh) are blanked and can no longer be used, and an audit entry records that it happened. Blanking is all that disconnecting does: it does not delete the connection record. The connection record is retained after disconnect — the Google subject identifier, the email and display name captured at consent, the resource allow-list and the audit trail — and there is no operation that deletes a connection row. Revoking Switchboard's access from your Google Account's permissions page stops any further reads at the provider and likewise does not erase anything held here.
• Encryption keys and tokens are not written to the application logger or to the error messages it emits.

5. Sharing and disclosure

Switchboard does not sell, rent, or share Google user data with third parties. Google data is not transferred to any party for advertising, marketing, or analytics resale. Data is held by the operator and processed on the operator's own infrastructure.

One person does see it: the operator — the administrator who runs Switchboard and signed the connection up — reads the connected account's Search Console and Analytics figures in the private dashboard. That is the purpose of the tool, and it is limited to the account that authorised the connection. Data may otherwise be disclosed only if required by law, or to the connected account's own authorised owner on request.

6. Google API Services — Limited Use

Switchboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide the reporting features described above and is not used for advertising.

Google user data is read by a human: the operator views the connected account's figures in the private dashboard, and may also read the stored connection record while troubleshooting that connection. It is not made available to any other human, and it is not used to train or improve any machine-learning model.

7. Retention and deletion

A connection record and its stored credential are kept for as long as the connection is in place and the operator needs it, so that the connection keeps working without the operator signing in to Google again. There is currently no production retention policy in the implementation: no automated retention or expiry job runs, records are not deleted on a fixed schedule, and this policy deliberately does not promise a specific retention period that the implementation does not yet enforce. A retention period will be stated here only once one is actually implemented and verified.

You can ask for the deletion of a connection and its stored data at any time by writing to asarver@sarverenterprises.com. That request is handled manually by the operator: there is no automated purge, and no self-service control that erases the record. The operator can disconnect the connection, which blanks the stored tokens so they can no longer be used — that is what disconnecting does, and it is the only control that exists today. It does not delete the connection row: the stored connection record is retained (the Google subject identifier, the email and display name captured at consent, the resource allow-list and the audit trail of connection events), and no operation in the store deletes a connection row. Because of that, this policy does not present disconnecting as deleting the record. Deleting the retained row is a separate manual operator action, and this page will be updated when a code path that performs it exists.

Revoking Switchboard's access from your Google Account's permissions page is also a valid choice and stops further reads at Google, but — as noted in section 4 — it does not erase anything held here by itself.

8. Your choices

• You may revoke access at any time from your Google Account permissions page. This stops Switchboard reading anything further from Google for that account.
• You may ask for a copy of the connection data held for your account, or ask for it to be deleted. Deletion requests are handled manually by the operator; there is no automated purge, and disconnecting the connection — the only control that exists today — blanks the stored tokens rather than deleting the connection record (see sections 4 and 7).
• Because access is only ever granted by the account owner through Google's consent screen, no one else can connect your account to Switchboard.

9. Changes to this policy

This policy will be updated when the implementation changes — for example when a retention policy is introduced — and the "last updated" date above will change with it.