Privacy Policy

Google data and permissions

NIAR Marketing connects to Google with the account holder's OAuth consent. The current setup uses a Desktop OAuth client, authorized in the owner's browser, and a private server runtime. The application receives access tokens, refresh tokens and granted-scope information and uses the configured Google account email. Google handles the account password.

Google Ads · adwords

This scope permits viewing, creating, editing and deleting Ads accounts and data, subject to the user's account rights. Accessible-account discovery has been verified. Production campaign queries remain subject to Google API approval; campaign-changing tools are pending implementation.

Google Analytics · analytics.readonly

Read access to available Analytics data and metadata. Account and property metadata discovery has been verified. Full GA4 report tools are planned.

Search Console · webmasters.readonly

Read access to available Search Console data. Site discovery has been verified. Search performance reporting tools are planned.

Results may contain account and resource names and identifiers, website addresses, access levels and diagnostic statuses. Project profiles contain intended workflows and source mappings where configured. The currently exposed MCP tools return project profiles, connection readiness and missing source settings.

Purpose and limits

Google data is currently used to diagnose connections, discover accessible sources and configure marketing projects. The tool's development roadmap includes SEO research, keyword planning, advertising workflows and analytics. Current availability is stated on the application page.

NIAR Marketing uses Google data and derived results for the user's selected project task. It does not sell this data, provide it to data brokers, use it for personalized advertising targeting or train its own models on it.

Use of Google API data must follow the Google API Services User Data Policy, including applicable Limited Use requirements. This policy describes the application's handling of data; publication does not establish Google verification or approval.

Google, the server and Codex/OpenAI

The private server calls Google APIs over HTTPS and sends Google the request details and authorization needed to perform the request. OAuth token exchange and refresh also communicate with Google.

When the user invokes the integration through Codex, tool results and data selected for the task are sent to Codex/OpenAI. These are processed with the conversation context to produce a response or work result. Diagnostic results can already include the configured account email, project details and connection statuses.

The owner initiates these tasks and tool calls. Processing, history retention and any provider use of this context depend on the terms and settings of the OpenAI account used. NIAR Marketing does not control those settings or promise a particular provider retention period. See OpenAI's Privacy Policy.

OAuth client secrets and full tokens are excluded from diagnostic tool responses. The operator and server administrators can access the systems and data required to maintain the integration. Any additional sharing requires a separate basis and agreement with the user.

Credentials and task results

The active runtime is hosted on the owner's private Linux server. OAuth client configuration and tokens, including the refresh token, are encrypted at rest using systemd's host credential mechanism. Root-owned credential files and a dedicated operating-system user separate the runtime from other applications. The server's administrators can access the host key and runtime; encryption does not prevent administrative access.

The existing authorization is provisioned from macOS Keychain to the server over SSH without a plaintext export file. A provisioning copy remains in the owner's macOS Keychain. Future browser authorization can be completed on the Mac and provisioned again. Google passwords are not stored by NIAR Marketing.

Credentials are decrypted in process memory for authorized API use. Refreshed credentials are saved back to encrypted storage. Project profiles are stored in a server-side configuration file separately from credentials. Temporary OAuth request files created on the Mac have restricted permissions and are removed when authorization finishes.

The current release has no separate marketing-report database. API results are processed in memory. Data included in conversations, local session history or user-saved files may remain on the client computer, server or Codex/OpenAI, depending on where it is saved.

The application has no automatic deletion schedule or universal retention period. Credential records and project configuration remain until manually removed. Saved files and conversation histories follow the handling of the systems that hold them. Encrypted server backups, when made, also require separate handling.

Revoke access and request deletion

1. Open third-party connections in Google Account using the account that granted access.
2. Select NIAR Marketing, review its access to your Google Account, then remove access and confirm. Labels may vary by interface language. See Google's instructions.
3. To remove stored credentials, project settings or retained copies controlled by the operator, contact niar.personal@gmail.com. Identify the relevant account and project. Do not send passwords or tokens.

Revocation stops further authorized access to Google data. Previously obtained copies, the server credential records, the Mac provisioning copy and saved conversations or files need separate deletion. The operator reviews requests manually, identifies records under their control and removes the relevant records. A self-service deletion interface and an automatic completion deadline are not implemented.

Manage Codex/OpenAI history and files through the relevant account and OpenAI's available controls. Removing integration credentials does not delete those copies or the original Google Ads, Analytics or Search Console accounts and data.

Public information pages

The application and policy pages are publicly accessible. They do not request OAuth access or accept tokens and contain no forms, analytics scripts or third-party fonts. Assets load from niar42.com. The web server receives ordinary HTTP request information, including IP address and browser information.

Material changes to data access, purpose or recipients will be reflected here with an updated date. The user must receive appropriate notice and provide any required consent before data is used in a newly disclosed way.

Questions and deletion requests: niar.personal@gmail.com.