Security & Data Privacy
~4 min readWhat access we request
dashboardSMASHBOARD requests the following OAuth scopes when you sign in with Google:
| Scope | Purpose |
|---|---|
openid |
Confirms your identity |
email |
Associates your account with your email address |
profile |
Reads your name and profile picture for display |
analytics.readonly |
Reads your GA4 property data (reports, property list) |
analytics.readonly is a read-only scope. dashboardSMASHBOARD cannot create, modify, or delete anything in your Google Analytics account, properties, or data streams.
What we never do
- We never write to your Google Analytics account.
- We never access Google properties you have not selected.
- We never share your GA4 data with third parties.
- We never store raw GA4 report data on our servers beyond what is needed to display your current dashboard.
How tokens are stored
After you authorise dashboardSMASHBOARD, Google issues an access token (short-lived) and a refresh token (long-lived). Both are:
- Encrypted at rest using AES-256-GCM before being written to the database.
- Never logged or included in error reports in plain text.
- Refreshed automatically when the access token expires — you stay signed in without re-authorising.
If you revoke access from your Google Account settings (Security → Third-party apps with account access), dashboardSMASHBOARD's tokens are immediately invalidated. The next time you open your dashboard, you will be prompted to sign in again.
Google's Limited Use requirements
dashboardSMASHBOARD's use of Google Analytics data complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use your GA4 data only to provide the dashboardSMASHBOARD service to you.
- We do not use your data for advertising or to build profiles for third parties.
- We do not allow humans to read your data unless you have explicitly requested support and provided consent.
What data we store
| Data | Stored |
|---|---|
| Google account ID, email, name, picture | Yes — used for your account identity |
| Encrypted access and refresh tokens | Yes — required to fetch your GA4 data |
| Selected GA4 property ID and display name | Yes — required to run your queries |
| Goal configurations and thresholds | Yes — your dashboard settings |
| Raw GA4 report data | No — fetched on demand, not stored long-term |
Deleting your account
To delete your dashboardSMASHBOARD account and all associated data, open the account menu and select Delete account. This permanently removes:
- Your account record
- All stored tokens (access and refresh)
- All dashboard and goal configurations
You should also revoke dashboardSMASHBOARD's access from your Google Account security settings to ensure the tokens cannot be re-used.
Contact
For privacy questions or data requests, contact privacy@dashboardsmashboard.com.
Still need help?