Holy Bucket ("we", "us") makes an app that reads your Google Analytics and Search Console data and shows it to you in plain English. This explains what we collect, how we use it, and the choices you have. We keep it short and honest.
What we collect
- Your account details. When you sign in with Google, we receive your name and email to create and secure your account.
- The analytics data you connect. With your permission, we read your Google Analytics 4 and Google Search Console data. Read only. We never create, edit, or delete anything in your Google account.
- Bing search data, if you connect it. You can optionally add a Bing Webmaster Tools API key to read your Bing search performance alongside Google. We store that key encrypted and use it only to read your Bing data — read only.
- Product usage. Basic, privacy-respecting analytics about how the app itself is used, so we can improve it.
- Anything you send us. Emails, support messages, and waitlist signups.
How we use your Google data
When you connect Google Analytics or Search Console, you grant read-only access through Google’s official OAuth consent screen. We use that access for one thing: to fetch your metrics and show you your dashboards inside Holy Bucket.
Holy Bucket’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use your Google data for advertising. We do not sell it. We do not transfer it to others except as needed to run the service (see below). And we do not allow humans to read it, except for security purposes, to comply with the law, or with your explicit permission.
How we use everything else
To provide and improve the service, secure your account, respond to you, and send essential service messages. We do not sell your personal data. Ever.
Who we share your data with
We do not sell your data, and we never share, transfer, or disclose your Google user data for advertising or to data brokers. We share it only with the service providers below, only to operate Holy Bucket, and only to the extent needed:
- Cloudflare, Inc. — our hosting and storage provider. Your data is processed and cached on Cloudflare’s infrastructure so the app can run.
- Google’s Gemini API — when you open the AI summaries, we send the relevant analytics figures (such as page, traffic, and search numbers derived from your Google Analytics, Search Console, and, if connected, Bing search data) to Google’s Gemini API to generate the plain-English insights you requested. This data is not used to train any models and is never used for advertising.
- Microsoft (Bing Webmaster Tools) — only if you connect Bing. We use the API key you provide to read your own Bing search data from Microsoft. We do not send your data to Microsoft beyond the requests needed to read it.
- Legal and safety — we may disclose data when required by law, to comply with valid legal process, or to protect the rights, property, or safety of our users and the public.
How we protect your data
We treat the analytics data you connect and your Google account tokens as sensitive, and we protect them with the following measures:
- Encryption in transit. All data moving between your device, our servers, and Google travels over HTTPS/TLS.
- Encryption at rest. Your Google OAuth tokens and your Bing Webmaster Tools API key are encrypted before they are stored.
- Read-only, least privilege. We request the minimum Google scopes needed and only ever read your data — we never create, edit, or delete anything in your Google account.
- Restricted access. Access to the systems holding your data is limited, and no human reads your Google data except for security purposes, to comply with the law, or with your explicit permission.
- Short-lived storage and deletion. Analytics figures are cached only briefly and expire automatically; your Google tokens and Bing key are deleted when you disconnect that source or delete your Holy Bucket account.
How long we keep it
We keep your account data and connected-source tokens while your account is active. You can disconnect a Google account at any time, which deletes its tokens. If you delete your account, we delete your personal data and tokens. Cached analytics figures expire on a short cycle.
Your choices
- Disconnect any Google account from inside the app at any time.
- Disconnect Bing from inside the app at any time, which deletes your stored Bing API key.
- Delete your account and data by emailing hello@holybucket.app.
- Revoke Holy Bucket’s access directly from your Google Account security settings at any time.
Cookies
We use the minimum needed to keep you signed in, plus privacy-respecting product analytics. No advertising trackers.
Children
Holy Bucket is built for businesses and is not directed at children under 13.
Changes
If we change this policy we’ll update the date above, and for material changes we’ll tell you.
Contact
Questions about your privacy: hello@holybucket.app.