Applies to the hosted service at mcp-seo.akxan.com. The open-source server is self-hosted and sends nothing to us.
When you sign in with Google we store your Google account ID, email address, display name and avatar URL, plus an OAuth refresh token (encrypted at rest). We never see your password. MCP tokens we create for you are stored as hashes; the clear text is shown once.
The refresh token is used only to read Search Console and Google Analytics 4 data on your behalf when your AI assistant calls a tool. Results are returned straight to your assistant and are not retained, analysed or used to train any model.
The server logs the time, tool name, client type and duration of each call for troubleshooting and abuse prevention. Arguments and results are not logged. Logs are deleted after 30 days.
Audit tools fetch the public URLs you provide and call Google PageSpeed Insights, Chrome UX Report and Google Knowledge Graph on your behalf. We do not sell or share your data with anyone.
Data is kept until you disconnect. "Disconnect Google account" in the dashboard revokes the Google grant and deletes your record and all tokens immediately. You can also revoke access at your Google account permissions.
https://github.com/Akxan/google-seo-mcp/issues