Privacy policy

Who we are

MetricDeck operates metricdeck.app from India. For anything in this policy, including a request to see or delete your data, write to hello@metricdeck.app.

The short version

• We only read from the accounts you connect, and never change anything in them.
• We use your data only to show you your numbers, alerts, summaries and reports.
• We never sell it, use it for advertising, or use it to train AI models.
• Our AI writes summaries from numbers our code has already calculated. It is never trained on your data.
• You can disconnect a source, delete a project or delete your whole account at any time, and the data goes with it.

What we collect

• Your account. Your name, email address and password, and a profile picture if you upload one (or the illustration you pick). Passwords and two-factor login are handled by our authentication provider and stored only in hashed or encrypted form; we never see them. Also your workspace name and who belongs to it.
• Invitations. When a workspace owner invites someone, we store that email address with the invitation and send it one email with a link. The invitation is deleted when it's accepted, declined or withdrawn; until then only the workspace's owner sees it.
• Your projects. The names, website addresses, goals, currency and time zone you give each project, your report settings, and a logo if you upload one.
• Connected Google accounts. The account's ID, name, email address and profile picture as Google returns them, the permissions you granted, and the token that lets us read on your behalf, stored encrypted.
• Google Search Console (read-only): clicks, impressions, click-through rate, average position, and the search queries and pages behind them, for the properties you choose.
• Google Analytics (read-only): sessions, users, engagement, key events and revenue, by channel, source and medium, campaign, landing page, device and country, for the properties you choose.
• Google Ads (we only read): campaigns, cost, impressions, clicks, conversions and conversion actions, keywords and quality scores, the search terms people typed, and the account's change history, including the email address of the person who made each change, as Google Ads reports it.
• ChatGPT ads (OpenAI Ads), if you connect them: the API key you paste (stored encrypted), the ad account's ID and name, campaigns, ad groups, ads with their text and review status, and daily delivery and conversions.
• Microsoft Clarity, if you connect it: the Data Export API token you paste (stored encrypted), the Clarity project's ID, and per day, for the site and each of its pages by traffic channel and by device: visit, bot-visit and visitor counts, pages per visit, scroll depth, time per visit, and the share of visits with JavaScript errors, error clicks, rage clicks, dead clicks, quick backs and excessive scrolling. Clarity's API gives only these totals: no recordings, heatmaps, IP addresses or anything about a single visitor.
• Website checks. For each page you ask us to watch: whether it responds and how fast, its TLS certificate's issuer and expiry, its domain's expiry from public registries, speed and quality scores from Google PageSpeed Insights, and what an AI crawler can see on it (robots.txt, the page title, description and structured data, the sitemap and llms.txt).
• What we work out from it. Alerts, AI summaries, alert explanations, search-term reviews, the terms you mark irrelevant, and saved reports, which keep a copy of the numbers as they were when the report was made.
• Technical records. Our hosting providers keep server logs (IP address, browser, the page requested) for security and fixing faults. When something fails, an error report (what failed, the page, your browser and device type, without cookies or your IP address) goes to Sentry so we can fix it. On our public website only (not in the app, the sign-in pages or shared reports), Google Analytics counts visits and Microsoft Clarity records how pages are used (scrolls, clicks and mouse movement, with what you type in forms hidden) so we can improve the site; neither ever sees your account or any data you connect. Each time someone signs in to your account, we note when, whether it worked, the country of the connection and the browser and device type (not the IP address), and keep it 90 days to keep accounts secure. When you use one of our free tools (the AI search checker, the security headers checker), we keep a record of each check for 12 months to see how the tools are used: the address checked and the result, when, your account if you're signed in, your country, browser and device type, and the site or campaign that sent you, never your IP address. A scrambled (keyed hash) form of the IP address is kept for 2 days, only to limit how often the tools can be run.

How we use it

Only to run the service you signed up for:

• to calculate and show your metrics, charts, alerts, summaries and reports;
• to send the emails the service needs: sign-up and password-reset codes, security notices and messages about your account, and, unless you turn them off (Account, or the link in each one), an email when a critical alert opens and a weekly summary of your workspace;
• to keep the service secure and working, and to fix problems you report;
• where the law requires it.

We do not sell your data, share it with advertisers, use it to build profiles, or use it for advertising of any kind.

Google user data, and Google's Limited Use requirements

MetricDeck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• We use Google user data only to provide the features you see in MetricDeck: your metrics, charts, alerts, AI summaries, explanations and reports.
• We transfer it only to the service providers listed below, and only to provide those features, to keep the service secure, or to comply with the law.
• We never use it, or sell it, for advertising, including retargeting and personalised or interest-based ads.
• No person at MetricDeck reads it unless you ask us to (for example, to investigate a problem), it is needed for security, the law requires it, or it is aggregated and anonymised for running the service.
• We never use it to develop, improve or train generalised AI or machine-learning models, ours or anyone else's.

You can stop us reading at any time: disconnect the account on the Connections page (we revoke our access with Google and delete what we synced), or remove MetricDeck from your Google account permissions.

What goes to AI

MetricDeck uses Anthropic's Claude to write summaries, explain alerts and review search terms. Our code calculates every number first. Then it sends Anthropic only what the text needs: those numbers, the names of your project, properties, campaigns and pages, search terms, your site's title and description, the alert details and short descriptions of recent account changes.

This happens after a sync and when you ask for an explanation or a rewrite. Anthropic processes it as our service provider under its commercial terms and does not use it to train its models. The text it writes is stored in your workspace.

Who else handles it

A small number of providers process data on our instructions, only to run the service. The current list, with what each does and where, is on our subprocessors page. In short: hosting (Cloudflare), database and sign-in (Supabase), background syncing (Trigger.dev), AI writing (Anthropic), email (Resend), error reports (Sentry) and Google's PageSpeed Insights and favicon services for site checks.

If you subscribe to a paid plan, your payment is handled by Dodo Payments, our payment provider, which acts as the seller (merchant of record) and handles tax, receipts and invoices. We never see or store your card number. We keep your subscription's plan, status and billing dates, and Dodo's reference numbers for you and your subscription, so your plan follows what you pay for.

Where it is stored

Our database is in Mumbai, India (Amazon Web Services, through Supabase). The app is served from Cloudflare's global network, and some providers above process data in other countries, including the United States. Where data leaves your country, we rely on our providers' data protection terms, including standard contractual clauses where they apply.

How we protect your data, including sensitive data

We treat as sensitive the Google user data you let us read (Search Console, Analytics and Google Ads), the Google, OpenAI Ads and Clarity credentials that let us read it, your login details, and the personal information in your account. These are the safeguards that protect it:

• Least access. We request only the Google permissions MetricDeck needs: read-only for Search Console and Analytics. Google Ads has no read-only permission, so we request the standard one and use it only to read; nothing in the app can create, edit, pause or spend. You choose which properties and ad accounts each project reads.
• Encryption in transit. Everything between your browser, our servers, Google and our providers travels over TLS, and HTTPS is enforced (HSTS) on every page.
• Encryption at rest. Our database and its backups are encrypted at rest (AES-256). On top of that, Google logins (refresh tokens) OpenAI Ads keys and Clarity tokens are encrypted by our own code with AES-256-GCM, decrypted only on our servers when a sync needs them, and never sent to your browser or written to logs.
• Secure sign-in. Passwords are handled by our authentication provider and stored only in hashed form. New accounts confirm their email with a one-time code, two-factor login is available, and passwords on shared reports are stored hashed and lock after repeated wrong tries.
• Each customer's data is kept apart. Every record belongs to one workspace, and every page and action checks that the signed-in person belongs to it before reading anything. Row-level security is on for every table, the database can't be reached through a public API, and an automated test suite checks that one workspace can't read or change another's data.
• Limited human access. No person at MetricDeck reads your Google user data except in the cases listed under Google's Limited Use requirements above, and access to our production systems is limited to the people who run MetricDeck. To give support, keep the service secure and handle billing, they can see account details (your email, name, plan, sign-in history, and your projects and which kinds of source they use, never the data in them or names that come from Google), and every change they make to an account is logged.
• Data minimisation. We send our AI provider only the figures and names a summary needs, error reports leave out cookies and IP addresses, and IP addresses for the free tools are kept only in scrambled (keyed hash) form, for 2 days.
• Short retention and real deletion. Removing a source, disconnecting an account or deleting your account deletes the data we synced, and disconnecting or deleting revokes our Google access. Backups expire within 7 days, and logs and error reports within 30 days.
• Trusted providers. Data is processed only by the providers listed above, under their data protection terms, and our hosting and database providers (Cloudflare and Supabase) are independently audited (SOC 2 Type II).
• If something goes wrong. If a security incident affects your personal data, we will contain it, tell you without undue delay, and notify the authorities where the law requires.

More detail, including how to report a vulnerability, is on our security page.

How long we keep it, and how to delete it

• We keep synced data while the source stays connected.
• Removing a source from a project deletes the data we synced for it.
• Disconnecting an account on the Connections page deletes every source that used it and their data. For Google we also revoke our access; for OpenAI Ads and Clarity we delete the key or token, and you can revoke it in OpenAI's Ads Manager or Clarity's settings.
• Deleting a project deletes everything in it, including its saved reports.
• Deleting your account (Account page → Delete account) removes your workspace, every project and all synced data, reports and settings, and your login, straight away. We revoke our Google access and email you a confirmation.
• Sign-up and reset codes are deleted after a day. Copies in our database host's backups expire within 7 days, and server logs and error reports within 30 days.

Cookies

In the app we only use cookies the service needs: to keep you signed in, to complete a Google sign-in safely, to remember whether the sidebar is open, and to open a password-protected shared report. Your light or dark theme is remembered in your browser. On our public website, Google Analytics and Microsoft Clarity set analytics cookies to tell one visit from the next; for visitors in the European Economic Area, the UK and Switzerland they run without cookies. You can block them in your browser or with the Google Analytics opt-out add-on. We use no advertising cookies, and Google's advertising features are off.

When you connect a client's accounts

If you connect accounts that belong to your clients, you confirm you're allowed to, and we process that data on your behalf and on your instructions. A data processing agreement is available on request.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, or object to how we use it. Write to hello@metricdeck.app and we'll answer within 30 days. Depending on where you live (for example under the GDPR, UK GDPR, California's privacy laws or India's Digital Personal Data Protection Act), you may also complain to your data protection authority. We do not sell or share personal information for cross-context behavioural advertising.

Children

The service is for businesses and is not directed at anyone under 18.

Changes

If this policy changes in a way that affects you, we'll update the date at the top and tell you by email or in the app before the change applies to data we already hold.