Clear about data.
Careful with access.

Workspace information.

The service stores the websites its owner adds, captured public page content, review findings, drafts, activity, and saved settings. When AI monitoring is enabled, it also stores the monitoring question, returned answer, citations, and usage records. Workspace information is available through the protected application, not these public pages.

Google connections.

The owner may authorize read-only access to Google Search Console and Google Analytics, then select a property. The service uses that access to retrieve property information and performance reports for the protected workspace. People authorized to use this shared workspace may see connected reports. The service stores the connected account email, selected property details, authorization credentials, and report results used by its reporting features. Google access and refresh tokens are encrypted on the server; that statement does not mean every stored report or workspace record is separately encrypted. These credentials are not included in analytics events or public pages.

Objective Discovery Observatory follows the Google API Services User Data Policy, including its Limited Use requirements, for Google API data. We use connected Google data for the reporting functions the user chooses, not for advertising or selling that data.

Google-connected report tools are disabled for AI assistants in this release. This does not erase information previously saved in reports, project notes, or chat transcripts, or prevent a user from manually submitting information to an assistant. Connecting Google does not by itself authorize a new AI-sharing feature.

These connections do not edit your Google properties or publish website changes. Disconnecting a property removes its workspace mapping. Removing a Google account from the service removes its stored authorization and affected mappings; neither action automatically purges existing reports, caches, conversations, or backups, and neither revokes the grant in your Google Account. You can revoke Objective.cc's access in your Google Account's third-party connections settings. Contact us if you need help removing stored connection information.

Who receives Google user data.

Google user data obtained through our connections includes the connected account's email and identity, selected property details, Search Console and Analytics report results, and the authorization credentials needed to retrieve those reports. We share, transfer, or disclose that data to the following recipients for these purposes:

• Google: the service sends authorization credentials and requests identifying the selected Google property and report parameters to Google's authentication, Search Console, and Analytics services. Google uses these requests to authorize the connection and return the reports you request.
• DreamHost, our hosting provider: connected account information, selected properties, report records, and encrypted Google access and refresh tokens are stored and processed on our DreamHost-hosted VPS, including retained application backups. This enables hosting, storage, operation, and recovery of the workspace. Token encryption does not mean all report records or backups are separately encrypted.
• People authorized to use or administer this workspace: connected account labels, property selections, and reports are available to authorized workspace users. Owner and agency views share the same protected workspace. Administrators may access stored records when needed to operate, secure, troubleshoot, or respond to support and deletion requests.

Optional AI features are separate from the Google reporting connection. OpenAI receives monitoring questions when AI observations are requested. If the general assistant is configured, OpenRouter and its selected model provider receive assistant inputs, including messages, shared project context, and relevant conversation history. If you place Google-derived information in those inputs, that information can be disclosed to those providers. Direct Google-report tools for AI assistants and external MCP are disabled in this release; connecting Google does not itself enable those transfers. The service does not automatically include Google authorization credentials in AI inputs.

We do not sell Google user data or share it with advertisers or data brokers. We do not use connected Google data for advertising, and we do not publish connected account information or reports on these public pages.

How we protect Google user data.

We use the following safeguards to protect sensitive Google user data, including connected account identity, property information, reports, and authorization credentials, against unauthorized access and disclosure:

• Encrypted connections: HTTPS protects data in transit between your browser and Objective.cc and between our service and Google authentication and reporting APIs.
• Protected storage: Google access and refresh tokens are encrypted before storage using a server-held encryption secret. Server configuration files, the private workspace storage directory, and application backups are protected by operating-system access permissions. Token encryption does not mean that every report, workspace record, or backup is separately encrypted.
• Authenticated access: the workspace requires sign-in and uses expiring sessions with Secure, HttpOnly, and SameSite cookies. Password verification uses a salted password hash, and sign-in attempts are rate-limited. Administrative access is restricted to the people administering this workspace. Owner and agency views share the same protected workspace; they are not separate customer security boundaries.
• Limited access and exposure: the Google connections request read-only permissions for the reporting features you choose. Connected account information, authorization credentials, and private reports are not published on our public information pages. Direct Google-report tools for AI assistants and external MCP remain disabled as described above.

These safeguards reduce risk but cannot guarantee absolute security. If you have a concern about your connected data, contact khalid@objective.cc.

Service analytics and cookies.

The application uses Google Analytics 4 to understand basic service usage. Analytics events use general page categories instead of private workspace URLs or content. They do not include connected account emails, site names, search terms, drafts, or private page content. Advertising signals and advertising personalization are disabled.

Google Analytics may use cookies and process browser, device, and network information to produce usage statistics. You can manage cookies in your browser and block analytics requests. These public About and Privacy pages contain no analytics script or tracking assets.

Hosting and service providers.

DreamHost hosts the application and its stored workspace records. Google processes the requests needed for connected reports and service analytics. When the owner enables AI observations, the monitoring question is sent to OpenAI to obtain a web-search answer and citations. Google authorization credentials are not sent to the AI observation service. An optional general assistant can use a configured OpenRouter provider and store conversation history; its direct Google-report tools are disabled in this release.

Hosting and application logs may record operational request information to run the service and investigate errors. Administrative access is restricted to the people administering this private workspace.

Retention and your choices.

Workspace records, stored reports, cached results, conversation transcripts, and backups support the operation and recovery of the service. A cached result becoming too old to use does not automatically delete its stored copy. Archiving a conversation does not delete its transcript. This notice does not state a fixed retention period or promise an automatic purge of historical information.

To ask about access, correction, deletion, or a stored connection, contact khalid@objective.cc. Requests to remove retained information are handled by the workspace administrator. Removing a live record may not immediately remove copies in backups.

You can stop scheduled monitoring in the workspace, disconnect selected properties, remove a stored Google account, and revoke Google account access separately. A change to analytics or a Google connection does not publish website content.

Contact.

Questions about this notice or Objective.cc's handling of information can be sent to khalid@objective.cc.