Privacy policy

Effective 2026-10-30. Applies to Serpherd at serpherd.com.

Serpherd connects AI clients (Claude, ChatGPT, Cursor and other MCP clients) to Google Search Console. This page explains what Google user data it accesses, how it uses, stores and shares that data, and how you delete it.

Google user data we access

• Your Google profile: name, email address and profile picture, to identify your account.
• Search Console: with your permission, Google lets the service read your Search Console data (read-only). If you turn on write access for an account on the dashboard, Google also lets the service manage that account's Search Console properties and sitemaps and verify ownership of new sites (Site Verification). The permission is stored as an encrypted OAuth refresh token for each Google account you connect.

How we use it

Only to provide the features you use:

• answering requests from the AI clients you connect: search analytics, URL inspection, sitemaps, property lists, and, with write access turned on, changes your agent makes on your instruction (adding properties and sitemaps, verifying domains);
• keeping a daily history of totals per property (clicks, impressions, CTR, average position) so you can look back further than Google's 16 months;
• daily checks and alerts: traffic drops, lost access, sitemap errors, homepage indexing status, and whether your homepages appear on Google Web Risk lists.

We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models. No person reads your data unless you ask us to for support, it is needed to investigate abuse or keep the service secure, or the law requires it.

Serpherd's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we store

• Account: your Google profile above, sign-in sessions (with the IP address and browser of each session) and the encrypted Google tokens.
• Search Console: the list of your properties with their permission level, the daily totals above, and the results of the daily checks. Data your agent requests on demand, such as queries, pages and inspection results, is passed to your AI client and not written to our database.
• Settings you create: alert rules and alert events, API keys (stored only as SHA-256 digests), the AI clients you authorized (tokens stored only as digests), your Telegram chat ID and username if you link Telegram, and your Cloudflare API token, encrypted, if you connect Cloudflare.
• Usage counts: how many times each tool was called per day and through which connected client, with errors and duration, never the arguments or results.
• Server logs: technical events with a shortened user ID and counts, without tokens or Search Console content.

To run the service, the operator sees account-level figures: your email, the number of connected Google accounts and properties, sync status and usage counts. Not your Search Console data.

Who receives data

• Your AI client receives what its requests return. You choose and authorize it; its provider handles that data under its own policy.
• Google: Search Console, Site Verification, PageSpeed Insights, Chrome UX Report and Web Risk APIs receive the requests needed to answer you, including the URLs to check.
• Cloudflare, if you connect a Cloudflare token: the DNS records that prove domain ownership are created in your zones.
• Telegram, if you link it: alert messages with site addresses and numbers.
• Infrastructure: the hosting and network providers that run the service, its database and the proxy in front of it.

We share data with no one else, except when the law requires it.

Retention and deletion

Data is kept while your account exists. On the dashboard you can disconnect a Google account (its access is revoked at Google; history already collected stays) or delete your account: that removes everything above from the database at once and revokes the Google access. Nightly database backups are rotated, so deleted data leaves them within 14 days. You can also remove the service's access at any time in your Google Account permissions.

Security

All traffic uses HTTPS. Google and Cloudflare tokens are encrypted at rest (XChaCha20-Poly1305); API keys and the tokens we issue to AI clients are stored only as digests. Each user's requests run with that user's Google tokens only.

Cookies

One session cookie keeps you signed in; short-lived cookies protect the Google sign-in. No analytics or advertising cookies.

Children

The service is not directed at children under 16.

Changes

We may update this policy; the date at the top shows the current version.

Questions and data requests: [email protected].