Privacy Policy

At GA4 MCP (accessible at https://ga4mcp.com and via open-source package repositories), we treat privacy as an architectural guarantee. This Privacy Policy details how GA4 MCP accesses, processes, and protects your data when you use the open-source software and connect your Google Analytics accounts.

1. Information We Access

When you choose to authenticate via 1-Click Google Sign-In, GA4 MCP requests the following permissions from your Google Account:

• Google Analytics Read-Only Access (https://www.googleapis.com/auth/analytics.readonly): This scope allows your local AI agent (Claude Desktop, Cursor, Claude Code, Cline, etc.) to read Google Analytics 4 property metadata, report schemas, and traffic/conversion reports solely in response to prompts you explicitly initiate.
• Basic Profile & Email (openid, profile, email): Used solely to identify which Google account you have connected in your local environment display.

2. How Your Data Is Used

Your Google Analytics data is queried in real time directly from your local workstation:

• Local Agent Query Execution: When you prompt an AI model in your IDE (e.g. "What were my top referral channels this week?"), the local GA4 MCP server constructs a read query and transmits it directly to Google's official Analytics Data API.
• Immediate In-Context Analysis: The returned data is delivered directly into your local IDE or terminal session so the model can answer your question.

3. Google API Services User Data Policy Compliance (Limited Use Disclosure)

GA4 MCP's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• No Third-Party Data Transfer or Sale: We do not transfer, disclose, share, or sell your Google user data to any third parties, data brokers, or advertising networks for purposes other than providing the core analytics services requested.
• No Advertising: We do not use or transfer your Google Analytics data to serve personalized, re-targeted, or interest-based advertisements.
• No Non-Personalized AI/ML Model Training: Google user data and analytics information accessed via Google APIs is never used to develop, improve, fine-tune, or train non-personalized AI and/or machine learning models, foundational models, or public LLMs.
• No Human Review: No human (including GA4 MCP maintainers or server administrators) has access to or reads your Google Analytics data, reports, or tokens. Queries execute entirely programmatically between your local machine and Google.

4. Data Protection Mechanisms for Sensitive Data

GA4 MCP implements comprehensive technical and operational safeguards to protect sensitive Google user data (including OAuth tokens and analytics reporting data):

• Security Procedures in Place: Strict security procedures and organizational controls are in place to ensure the confidentiality, integrity, and availability of all data processed by GA4 MCP.
• We Use Encryption to Protect Your Information: Industry-standard cryptographic protocols are enforced at every stage of data handling, both in transit and at rest.

A. Protection of Data in Transit

• Strict TLS Encryption: All communications between your local workstation, the Google Analytics APIs (analyticsdata.googleapis.com, analyticsadmin.googleapis.com), and Google OAuth 2.0 endpoints are encrypted in transit using Transport Layer Security (TLS 1.2 and TLS 1.3) over HTTPS.
• No Unencrypted Channels: Plaintext HTTP transmissions of sensitive data or authentication tokens are strictly disallowed across all components of the application.

B. Protection of Data at Rest

• Local Workstation Storage & Restricted File Permissions: Your sensitive authentication credentials (OAuth refresh tokens and access tokens) reside exclusively on your local filesystem at ~/.config/ga4-mcp/session.json (or vault.json). This file is created with restricted operating system permissions (Unix chmod 0600), ensuring that only your local operating system user account has read/write access.
• Operating System Full-Disk Encryption: Stored credentials benefit from your workstation's underlying hardware and operating system disk encryption mechanisms (such as macOS FileVault, Windows BitLocker, or Linux LUKS).

C. Stateless Ephemeral Edge Gateway (Zero Server Storage)

• Ephemeral Relay Only: During 1-Click Browser Sign-in, Google redirects an authorization code to our gateway (ga4-gateway.reachsuren.workers.dev). The gateway executes an atomic exchange with Google's OAuth token endpoint, returns the resulting token bundle directly to your local loopback listener (http://127.0.0.1:18443), and immediately wipes the tokens from memory.
• Zero Persistent Databases: The edge gateway maintains zero persistent databases, zero caches, and zero credential logs. No sensitive Google tokens or user information are ever persisted on our cloud servers.
• Direct Analytics Payloads: All Google Analytics Data API queries and reporting payloads stream directly between your local machine and Google's servers. Reporting payloads never traverse or get retained on any intermediary servers.

5. Data Retention and Deletion

We believe in absolute data minimization and transparent data lifecycles:

• Retention Period: We store your personal information and authentication tokens locally on your machine only for the length of time needed to fulfill the analytical purposes outlined in this privacy policy, or until you choose to delete them or revoke access.
• Zero Server Retention: Our edge infrastructure retains zero Google user data, zero analytics payloads, and zero credentials (0 seconds retention).
• Disposal & Deletion Upon Expiry: When your data retention period expires or when you choose to discontinue using GA4 MCP, all local data can be permanently deleted immediately.
• How to Delete Local Data: You can delete all local tokens, configurations, and cached schemas at any time by executing:
  rm -rf ~/.config/ga4-mcp
• How to Revoke Google Account Access: You can revoke GA4 MCP's authorization at any time directly from your Google Account by visiting Google Account Permissions Settings and selecting "Remove Access". Once revoked, all existing OAuth tokens are permanently invalidated by Google.

6. Alternative Offline Service Account Authentication

If you prefer not to use OAuth, GA4 MCP fully supports 100% offline authentication using your own Google Cloud Service Account key (GOOGLE_APPLICATION_CREDENTIALS) or Google Cloud Application Default Credentials (ADC). In this mode, no network connection to our OAuth gateway is ever initiated, and all authentication occurs directly between your workstation and Google Cloud.

7. Security Inquiries & Incident Contact

For privacy inquiries, security questions, or data protection reports, please contact the maintainer directly:

Surendran Balachandran
Maintainer, GA4 MCP
Email: [email protected]
GitHub: https://github.com/surendranb/google-analytics-mcp