This Privacy Policy describes how adop.tools ("we", "us", or "our") collects, uses, and protects information when you use our reporting service at adop.tools ("the Service"). We are operated by adop.tools, based in New Zealand.
1. Information we collect
OAuth tokens
When you connect your Google account, Google issues OAuth credentials that allow us to make API requests on your behalf. We store these credentials encrypted at rest (AES-256-GCM) in Cloudflare's KV storage, tied to a session identifier stored in an HttpOnly cookie on your browser. We do not store your Google username or password.
API query results
When a report widget loads, we proxy a real-time request to the relevant Google API (Google Analytics Data API, Google Search Console API, or Google Ads API) using your stored credentials. We do not store the response data. The data flows from Google to your browser via our Cloudflare Worker and is not written to any database or log. Our use of this data is described in detail in Section 2 below.
Report configuration
Your report layouts and settings are stored in your browser's localStorage. When you create a share link, the report configuration (not the underlying data) is stored in Cloudflare KV, associated with a random access token, for up to one year.
Usage analytics
We use Google Analytics 4 to understand how the Service is used in aggregate. This includes page views, session counts, and general feature usage. No personally identifiable information is sent to GA4 beyond what Google collects automatically (IP address, browser type, approximate location). This is our own first-party analytics about visitors to adop.tools and is entirely separate from the Google Analytics data we access on your behalf through the connected-account scopes described in Section 2.
Google AdSense
The free calculator tools on adop.tools display ads served by Google AdSense. Google may use cookies to personalise these ads based on your browsing history. The reporting section of the Service does not display AdSense ads, and AdSense is never informed by data obtained through the Google API scopes described in Section 2.
2. Google user data
When you connect your Google account, we request the OAuth scopes listed below and access the data described, solely to retrieve it and display it back to you within the Service. We request read-only access in every case.
- Google Analytics —
.../auth/analytics.readonly: read-only access to your Google Analytics 4 reporting data, including sessions, events and their parameters, and user counts. Used to render your analytics report widgets. No narrower or non-sensitive scope provides read access to GA4 property data. - Google Ads —
.../auth/adwords: read-only reporting access to your Google Ads account data, including impressions, spend, clicks, and channel type broken down by campaign. We issue reporting queries only and perform no create, edit, or delete operations. The Google Ads API exposes only this single scope and offers no separate read-only scope. - Google Search Console —
.../auth/webmasters.readonly: read-only access to your Search Console performance data, including clicks, impressions, queries, and pages. Used to render your search performance widgets.
This data is fetched in real time and proxied to your browser. It is never written to a database, never logged, and never used for any purpose other than returning it to you. The only Google-derived information we retain is your encrypted OAuth credentials, as described in Sections 1 and 3.
Limited Use disclosure
adop.tools's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not:
- transfer or sell this data to third parties, except as necessary to provide or improve the Service, for security purposes, or to comply with applicable law;
- use this data for serving advertisements, including personalised, retargeted, or interest-based advertising;
- allow humans to read this data, unless we first obtain your affirmative agreement to view specific data, it is necessary for security purposes or to comply with applicable law, or the data has been aggregated and anonymised and is used for internal operations;
- use this data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models.
3. How we use your information
- To authenticate your session and proxy API requests to Google on your behalf.
- To save and restore your report configurations between sessions.
- To enable report sharing via unique access links you create.
- To understand aggregate usage patterns and improve the Service.
We do not sell your personal information. We do not use your Google Analytics, Google Ads, or Search Console data for any purpose other than returning it to your browser in real time, as described in Section 2.
4. Data retention
- OAuth credentials: Retained until you disconnect your account or we delete your session. Sessions inactive for more than 90 days may be purged.
- Google API response data: Not retained. It is proxied to your browser in real time and never written to a database or log.
- Report configurations: Stored in localStorage on your device until you clear it. Share links expire after 12 months.
- Shared reports: Share records in our KV store are automatically deleted after 12 months, or immediately when you revoke the link.
5. Third parties
We share data with the following third parties as part of delivering the Service:
- Google LLC: OAuth provider and data source. Subject to Google's Privacy Policy.
- Cloudflare, Inc.: Infrastructure provider. Our Cloudflare Workers transit your Google API requests and responses, and our KV store holds only your encrypted OAuth credentials and your saved report configurations. Cloudflare does not store the underlying Google API response data. Subject to Cloudflare's Privacy Policy.
We do not share your Google user data, or any other personal information, with any other third parties.
6. Cookies
We use a single session cookie (adop_sid) to identify your session. This cookie is:
- HttpOnly — not accessible via JavaScript
- Secure — only transmitted over HTTPS
- SameSite=None with Partitioned, to allow cross-site requests to our Worker
Google AdSense and Google Analytics may set additional cookies. You can opt out of GA4 tracking using Google's opt-out browser add-on.
7. Your rights
Under New Zealand's Privacy Act 2020, you have the right to:
- Request access to personal information we hold about you.
- Request correction of inaccurate information.
- Withdraw consent and request deletion of your data.
To disconnect your Google account and delete your stored credentials, visit the reporting dashboard and use the disconnect option in your account settings. Disconnecting revokes our access to your Google data and deletes your stored OAuth credentials. You may also revoke our access at any time directly from your Google Account permissions page. To request complete data deletion, contact us at the address below.
8. Security
OAuth credentials are encrypted at rest using AES-256-GCM with a key stored in Cloudflare Worker secrets (not in source code or logs). All data in transit uses HTTPS/TLS. We do not log the content of API requests or responses.
9. Children
The Service is not directed at children under 13. We do not knowingly collect personal information from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be noted by updating the "Last updated" date above. Continued use of the Service after a change constitutes your acceptance of the revised policy.
11. Contact
Questions or requests regarding this Privacy Policy should be directed to:
adop.tools
New Zealand
admin@adop.tools