Privacy Policy

1. Introduction

M2 Analytics ("we", "us", "our") operates the analytics dashboard at analytics.m2planner.com. This policy explains how we collect, use, and protect information when you use our service.

2. Information We Collect

2.1 Account Information

When you create an account or are invited, we store your email address, name, and a hashed password. Passwords are hashed using PBKDF2 and are never stored in plain text.

2.2 Google Account Data (Optional)

If you connect Google Search Console, we request access to your Google account via OAuth 2.0 with the following scopes:

• Google Search Console (Webmasters) - to read search performance data (queries, clicks, impressions) and indexing status for your connected sites.
• Site Verification - to verify site ownership when linking properties.

We store your Google email address and encrypted OAuth tokens. We only access Search Console data for sites you explicitly connect. We do not access any other Google services, your Gmail, Google Drive, or personal data beyond what is listed above.

You can disconnect Google at any time from the site settings, which revokes our access and deletes stored tokens.

2.3 Website Analytics Data (Collected from Your Visitors)

When you install our tracking script on your website, we collect the following data from your website's visitors:

• Page URLs visited
• Referrer URLs
• Device type, browser, operating system, and screen resolution
• Country and city (derived from IP address)
• Language and timezone
• UTM campaign parameters
• Custom events (if configured by you)
• Web Vitals performance metrics (if enabled)

We do not use cookies for tracking. We generate anonymous session hashes that cannot be used to identify individual visitors. IP addresses are used only for geolocation and are not stored.

3. How We Use Your Information

• To authenticate you and maintain your session
• To display analytics dashboards and reports for your websites
• To fetch and display Google Search Console data (if connected)
• To send alert notifications (if configured by you)

4. Data Storage & Security

Data is stored on Cloudflare infrastructure (Workers, D1, Analytics Engine). OAuth tokens are encrypted at rest. Sessions expire after 24 hours.

5. Data Sharing

We do not sell, trade, or share your data with third parties. Data is only shared with Cloudflare as our infrastructure provider and Google when you explicitly connect Search Console.

6. Data Retention

Real-time analytics data is retained for up to 90 days. Aggregated daily rollups are retained indefinitely. You can delete a site and all its data at any time from the settings page.

7. Your Rights

You may request access to, correction of, or deletion of your personal data by contacting us. You can disconnect Google access and delete sites at any time through the dashboard.

8. Contact

For questions about this policy, contact us at privacy@m2planner.com.