Security & Data Privacy

Security & Data Privacy

What access we request

When you sign in with Google, dashboardSMASHBOARD asks for these permissions:

analytics.readonly is a read-only scope. dashboardSMASHBOARD cannot create, modify or delete anything in your Google Analytics account, properties or data streams.

What we never do

• We never write to your Google Analytics account.
• We never read properties you haven't selected.
• We never sell your data or share your Google Analytics data with third parties for their own use.
• We never see your payment card number — payments are handled by Stripe.

How sign-in tokens are stored

After you authorize dashboardSMASHBOARD, Google issues a short-lived access token and a long-lived refresh token. Both are:

• Encrypted at rest with AES-256-GCM before they're written to our database.
• Kept out of logs and error reports.
• Refreshed automatically, so you stay signed in without re-authorizing.

Revoking access

You can revoke dashboardSMASHBOARD's access at any time in your Google Account under Security → Your connections to third-party apps and services (myaccount.google.com/permissions). Once you do, dashboardSMASHBOARD can no longer read your Google Analytics data, and the app asks you to sign in again the next time you open it.

We check every day, and when we find that access has ended we schedule your account for permanent deletion 30 days later. Deletion removes your account record, stored tokens, dashboards, goals, share links and notification channels, and cancels any active subscription. To keep your data, sign in with Google again within those 30 days and the deletion is cancelled. Revoking access does not cancel your subscription, so cancel it first if you want to stop being billed.

Google API Services User Data Policy

dashboardSMASHBOARD's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use your Google Analytics data only to provide the dashboardSMASHBOARD features you see in the app.
• We don't use it for advertising, and we don't build profiles from it for third parties.
• We don't allow people to read your data unless you ask us for support and give consent, or it's needed for security or legal reasons.

What we store

Who handles your data

dashboardSMASHBOARD uses a small number of service providers to run the service — for example, Stripe for payments, a transactional email provider for account and alert emails, and hosting and error-monitoring services. They process data only to provide those services to us.

Deleting your account

To delete your account and its data, email privacy@dashboardsmashboard.com from the email address on your account and ask us to delete it. Deletion permanently removes your account record, stored tokens, dashboards, goals, share links and notification channels. If you have an active subscription, cancel it first from the pricing page (see Billing & Plans).

Also revoke dashboardSMASHBOARD's access in your Google Account permissions so the tokens can't be used again.

Signing out doesn't delete anything — your dashboards are waiting when you come back.

Shared links

A dashboard share link is an unguessable URL. Anyone who has the link can view that dashboard's last-refreshed numbers without signing in. You can set an expiry when you create the link and revoke it at any time. See Sharing & Exporting.

Contact

For privacy questions or data requests, contact privacy@dashboardsmashboard.com. For anything else, support@dashboardsmashboard.com.

Still need help? Open a support case