Privacy Policy
This policy applies to IDTCPack GA4, operated by Winndoo ("we", "us", or "our"). It explains how we access, use, store, and share your data when providing Google Analytics 4 (GA4) authorization, property selection, and traffic reporting. Other IDTCPack features are subject to the platform's applicable privacy policies.
1. Data we access and collect
- Authorization information: Access tokens, refresh tokens, and expiry information returned by Google OAuth, used to access your authorized GA4 data. We do not collect your Google password.
- Property information: Identifiers, display names, and types of GA4 accounts and properties you can access, together with your selected property and IDTCPack project identifier.
- Aggregate reports: Date, country, session source, medium, channel group, sessions, users, new users, engaged sessions, engagement rate, average session duration, events, key events, and revenue. The service does not request individual user activity records.
- Operational records: Authorization and synchronization timestamps, request nonces, idempotent responses, query ranges, row counts, statuses, and error information. Server access logs may include IP addresses, request paths, timestamps, and browser information.
2. Permissions and purposes
We use https://www.googleapis.com/auth/analytics.readonly to retrieve property lists through the Google Analytics Admin API and query reports for your selected property through the Google Analytics Data API. Offline access allows token refresh and authorized synchronization when you are not viewing the app. This permission is not used to modify your GA4 configuration or manage your Google Account.
Data is used only for the GA4 connections, project reports, channel classification, traffic analysis, troubleshooting, and necessary security measures associated with your use of the service. We do not sell Google user data or use it for advertising, ad targeting, data brokering, credit assessment, or training or improving general-purpose artificial intelligence or machine learning models. AI referral analysis classifies traffic by source name; it does not send your GA4 data to AI models.
3. Data sharing and human access
Query results are returned to IDTCPack for users authorized to access the relevant project to view and analyze. Google processes the information needed to complete authorization and API requests. Necessary infrastructure providers may process data only for hosting, storage, and security operations. We do not provide Google user data to unrelated third parties.
We do not allow routine human reading of Google user data. Necessary human access is permitted only with your explicit consent to view specific data, to investigate security issues, to comply with applicable law, or for internal operations involving aggregated and anonymized data as permitted by Google's policies. Other disclosures required by law or explicitly authorized by you are limited to what is necessary.
4. Storage location and security
The GA4 authorization gateway is hosted in Hong Kong, China. Access and refresh tokens are encrypted with Fernet before storage. Project associations, property lists, and synchronization audit records are stored in the gateway database. The browser dashboard displays reports directly without persisting report rows. For platform integrations, report details are returned to IDTCPack for storage; the gateway does not separately persist them. Using this service involves transmission and processing between the Hong Kong gateway, Google APIs, and IDTCPack. The processing location of platform reports is governed by the platform's privacy policy and your service agreement.
The production service uses HTTPS. Platform requests to the gateway use signature validation and replay protection, and service access is restricted. No technical measure can guarantee absolute security.
5. Retention, revocation, and deletion
The standalone browser dashboard stores its connection separately for each signed-in browser session. Browser connections expire after at most 12 hours; expired credentials are removed by scheduled housekeeping. Signing out deletes that browser connection's locally stored tokens and property list. Disconnect additionally attempts to revoke the Google grant. A shared application login does not share Google tokens or reports between browsers. Use Disconnect before leaving a shared device.
Credentials support ongoing connections while authorization remains active. When you disconnect through IDTCPack, the gateway clears the connection's stored access and refresh tokens and attempts to notify Google to revoke authorization. You can also remove this app from your Google Account third-party connections at any time. Revocation directly through Google invalidates subsequent API access but does not delete historical gateway records.
Revoking access does not automatically delete previously synchronized project reports, property snapshots, idempotency records, or audit logs. To delete these data or the entire connection record, email us using the address below and include your project identifier. After verifying your authority over the project, we will delete the relevant gateway and platform data, except for necessary records retained as required by law. Backup copies are removed through backup rotation. Do not email passwords, authorization codes, or tokens.
We retain data only as long as needed to provide the service, address security issues, or meet legal obligations, then delete or anonymize it. You may contact us to request access, correction, export, or deletion of data relating to you.
6. Cookies and third-party resources
Our public home, policy, and demonstration pages do not set analytics or advertising tracking cookies or load third-party analytics scripts. Application sign-in and the dashboard use essential session and CSRF cookies for login, browser-specific connections, and request security. The administrative interface may also use essential session and CSRF cookies. Google's authorization pages are managed by Google and are subject to the Google Privacy Policy.
7. Google API data use
IDTCPack GA4's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. Updates and contact
Updates will be published on this page with a revised date. Material changes to Google data access purposes or sharing practices will be communicated through platform notices or other appropriate means, and we will obtain renewed consent where required. This service is intended for businesses and professionals authorized to manage website analytics, and is not directed at children.
Operator: Winndoo
Privacy, support, and deletion requests: support@dtcpack.cn