Privacy Policy

Effective 22 October 2026 · Last updated 22 October 2026

Bikash Console ("the app", "we", "us") is a self-hosted dashboard for Google Search Console. This policy explains exactly what the app accesses, where that data is stored, how long it is kept, and how you can remove it. It applies to the hosted instance at https://bikash-console.pages.dev and to the same application when you run it on your own computer.

1. Who is responsible for your data

The app is operated by an individual developer, reachable at grownion@gmail.com. That address is also the contact point for any privacy request, including access, correction and deletion. The app is an independent project and is not affiliated with Google LLC.

2. What the app accesses

The app does nothing until you connect a Google account or supply a service account key. After that, and only for the Search Console properties you have granted it access to, it reads:

• Search performance data — clicks, impressions, click-through rate and average position, grouped by query, page, country, device, date or search appearance.
• URL inspection results — index verdict, coverage state, canonical URLs, last crawl time, robots.txt and page-fetch state, mobile usability and detected structured data for URLs you submit.
• Sitemap records — the sitemaps submitted for your properties, their last submission and download times, and their error and warning counts.
• The list of properties your account can access, together with your permission level on each.
• Your Google account email address, when you sign in with Google, so the interface can show which account is connected.

The app does not read your Gmail, Drive, Calendar, contacts, photos or any other Google service. Its access is limited to the Search Console scopes shown on the Google consent screen (webmasters, webmasters.readonly and, if you enable indexing notifications, indexing).

3. What the app does not collect

• No analytics, telemetry, crash reporting, advertising pixels or third-party trackers.
• No selling, renting or sharing of data for marketing purposes, ever.
• No access to data outside the Search Console properties you authorise.
• No passwords. The app never asks for, sees or stores your Google password; authentication happens on Google's own domain.

4. Why the data is processed

Data is processed for one purpose only: to display it back to you in reports, inspections and audits that you explicitly request. There is no profiling, no automated decision-making and no secondary use. Where the GDPR applies, the legal basis is your consent (you authorise access) and the performance of the service you asked for.

5. Where data is stored

Two deployments exist, with different storage:

• Hosted instance — configuration, credentials and audit results are stored in Cloudflare Workers KV, a key-value store operated by Cloudflare, Inc. Data is held in Cloudflare's edge network in the region nearest to you.
• Self-hosted instance — everything is written to plain JSON files inside a data/ folder on the machine where you run it. Nothing leaves that machine except the requests to Google's APIs.

Search performance figures and inspection results are fetched from Google when you request them and are not retained by the app beyond the audit runs described below.

6. Credentials

If you sign in with Google, the app stores an OAuth access token and refresh token. If you use a service account, it stores the service account's JSON key. Either is kept in the storage described above, encrypted in transit and protected at rest by the hosting provider. Credentials are used only to call Google's APIs on your behalf. Disconnecting removes them immediately.

7. Cookies and local storage

The hosted instance sets a single cookie, sc_sess, after you enter the access password. It is HttpOnly, Secure, SameSite=Lax, valid for 14 days, and contains only an expiry timestamp and a signature — no personal data. There are no advertising or analytics cookies. The app stores no data in your browser's local storage.

8. How long data is kept

• Audit runs (the list of URLs checked and their index status) — 60 days, then deleted automatically.
• OAuth tokens and service account keys — until you disconnect, revoke access in your Google Account, or the key is deleted.
• Settings and selected property — until you change or reset them.
• Daily quota counters — 30 days.
• Session cookie — 14 days, or until you sign out.

9. Third parties

• Google LLC — the source of all Search Console data, and the identity provider for sign-in. Your use of Google services is governed by Google's own privacy policy.
• Cloudflare, Inc. — hosting and storage for the hosted instance.

No other third party receives your data. There are no sub-processors beyond the two above.

10. Your controls and rights

• Disconnect in the app's settings removes stored tokens or keys.
• Clear run history deletes all stored audit results.
• Revoke access at myaccount.google.com/permissions invalidates the app's Google access independently of the app.
• Email grownion@gmail.com to request a copy of stored data or its deletion. Requests are answered within 30 days.

11. Security

All traffic is served over HTTPS. The hosted instance is protected by a password gate, and API routes require a signed session cookie. Credentials are never exposed to the browser. No system is perfectly secure, so you should still treat the access password as sensitive and revoke Google access if you suspect it has been compromised.

12. Children

The app is a professional tool intended for adults. It is not directed at children under 16 and does not knowingly process their data.

13. International transfers

The hosted instance runs on Cloudflare's global network, so data may be processed in a country other than yours. Cloudflare maintains standard contractual clauses for such transfers. Running the app locally avoids transfers entirely.

14. Changes to this policy

Material changes will be published on this page with a new effective date. Because the app has no mailing list, the date at the top of this page is the authoritative version marker.

15. Contact

Questions, access requests or deletion requests: grownion@gmail.com.