Privacy Policy

CurveSlicer is a browser-based tool that connects to your Google Search Console account to analyse click-through rate curves across ranking positions. This privacy policy explains how CurveSlicer handles your data.

For privacy questions, contact us at privacy@curveslicer.com.

When you sign in with Google and grant CurveSlicer permission, we request read-only access to your Google Search Console data using the https://www.googleapis.com/auth/webmasters.readonly scope.

This allows us to read:

• Search query strings associated with your verified properties
• Page URLs that appeared in Google Search results
• Click counts, impression counts, click-through rates, and average positions
• Country and device breakdown of that performance data
• The list of properties (websites) verified in your Google Search Console account

We request read-only access. CurveSlicer cannot and does not modify, delete, or submit any data to your Google Search Console account.

All data is stored exclusively in your browser's localStorage on your own device. This is a standard browser feature, similar to a cookie, that stores data locally on your computer.

Specifically:

• Search Console data fetched from Google's API is pre-aggregated in memory and written to localStorage. Raw query-level rows are never persisted.
• Processed analysis results (click curves, decay signals, narratives) are stored in localStorage.
• Your Google OAuth access token is managed by NextAuth.js and is stored in a secure, HTTP-only session cookie in your browser. It is not accessible to JavaScript and is not stored in localStorage.
• Your email address is stored in localStorage solely to detect when a different Google account signs in and automatically clear any previous data.

None of this data is transmitted to CurveSlicer's servers, third-party analytics platforms, or any other party. CurveSlicer does not operate a database or data warehouse. We have no access to your Search Console data.

Your data is used for one purpose only: to display click curve analysis to you, the authenticated user, within your browser session.

We do not:

• Sell your data to any third party
• Share your data with advertisers
• Use your data to train machine learning models
• Use your data for any purpose beyond displaying your own analysis back to you
• Aggregate your data with other users' data
• Access your data outside of your active browser session

CurveSlicer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In accordance with those requirements, CurveSlicer:

• Only requests Google user data for features that are directly visible and useful to the signed-in user
• Does not use Google user data for advertising purposes
• Does not allow humans to read your Google user data unless you explicitly request support that requires it and you have given explicit consent

We use Google OAuth 2.0 for authentication. When you sign in:

• Google authenticates you and issues a short-lived access token
• That token is used solely to make requests to the Google Search Console API on your behalf
• The token is managed by NextAuth.js in a secure session and is not stored in localStorage or any database we operate
• When you sign out, your session is cleared

CurveSlicer uses:

• Session cookie — a secure, HTTP-only cookie set by NextAuth.js to maintain your login session. It contains no personal data beyond what is needed to identify your session.
• Browser localStorage — used to cache your Search Console analysis data on your device. All localStorage entries are prefixed with cs_. You can clear all CurveSlicer data at any time by clicking "Clear data" within the app, or by clearing your browser's localStorage directly.

We do not use tracking cookies, advertising cookies, or third-party analytics that identify individual users.

You have full control over your data:

• Delete stored data — click "Clear data" in the CurveSlicer app at any time. This removes all analysis data from your browser's localStorage immediately.
• Revoke access — you can revoke CurveSlicer's access to your Google account at any time by visiting Google Account Permissions and removing CurveSlicer. After revoking, no further data can be fetched.
• Sign out — signing out clears your session cookie. Your localStorage data remains on your device until you clear it or click "Clear data."

Because we do not store your data on our servers, we cannot provide data exports or process data deletion requests on your behalf — there is nothing to delete on our end. All deletion is handled directly in your browser.

CurveSlicer retains no data on its servers because no data is ever sent to our servers. Data in your browser's localStorage remains until you:

• Click "Clear data" in the app
• Clear your browser's localStorage or site data
• Uninstall your browser

CurveSlicer is intended for use by website owners and SEO professionals. It is not directed at children under the age of 13. We do not knowingly collect data from children.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will make reasonable efforts to notify users. Continued use of CurveSlicer after changes constitutes acceptance of the updated policy.

Questions about this Privacy Policy or how CurveSlicer handles your data:

privacy@curveslicer.com