Skip to content

Privacy Policy

Last updated: March 24, 2026

This Privacy Policy explains how Nook Analytics, operated by Nook Analytics Inc., a British Columbia (Canada) corporation ("Nook," "we," "us," or "our"), collects, uses, stores, and protects information when you use our website at nookanalytics.com and related services (the "Service"). By using the Service, you agree to the practices described here.

1. Information We Collect

1.1 Account Information

When you sign up via Google OAuth, we receive your name, email address, and profile picture from your Google account. We also store your IP address and user-agent string with each authenticated session for security purposes.

1.2 Organization and Team Data

When you create an organization or invite team members, we store organization names, member roles, and invite email addresses.

1.3 Google Analytics Data

When you connect your Google Analytics 4 (GA4) properties, we access aggregated website metrics through the Google Analytics Data API (v1beta) using the analytics.readonly OAuth scope. The data we fetch includes:

  • Dimensions: date, page path, session source, session medium, device category, country
  • Metrics: sessions, active users, page views, key events (conversions), engagement rate, average session duration

This is aggregated website performance data. We do not access individual visitor data, user IDs, or any personally identifiable information about your website's visitors.

1.4 Google Search Console Data

When you connect your Google Search Console (GSC) properties, we access search performance data through the Search Console API using the webmasters.readonly OAuth scope. The data we fetch includes:

  • Dimensions: search query, page URL, device type, country
  • Metrics: clicks, impressions, click-through rate, average position

This is aggregated search performance data. We do not access any personally identifiable information about the people who searched for or visited your site.

1.5 Payment Information

Payments are processed by Stripe. We never receive or store your credit card number, CVC, or full card details. Stripe shares with us a Stripe Customer ID, subscription status, and billing email so we can manage your plan. Stripe's handling of payment data is governed by the Stripe Privacy Policy.

1.6 Usage Analytics

Cloudflare processes request metadata and operational logs to run and troubleshoot nookanalytics.com. These records can include IP addresses, request paths, timing, and error information.

1.7 OAuth Tokens

We store Google OAuth access tokens and refresh tokens to sync your data on an ongoing basis (every 6 hours). Access tokens are short-lived and automatically refreshed. You can revoke access at any time by disconnecting your Google account from Nook or by revoking Nook's access in your Google Account permissions.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Service
  • Display your GA4 and Search Console data in your Nook dashboard
  • Pre-compute daily, weekly, and monthly rollups for faster dashboard performance
  • Send transactional emails (trial reminders, weekly summaries, team invitations)
  • Process payments and manage your subscription
  • Authenticate your identity and secure your account
  • Respond to support inquiries
  • Detect and prevent abuse or fraud

We do not use your data for advertising, sell it to third parties, train AI models, or share it with anyone except as described in Section 4.

3. Cookies and Local Storage

We use a minimal set of cookies and local storage, all essential to the Service:

  • better-auth.session_token — Authentication session cookie. Set on login, expires when the session ends. Essential for keeping you signed in.
  • nook_org — Stores your preferred organization ID for the org switcher. Persists for 1 year. First-party, not shared with anyone.
  • nook_cookie_consent — Stored in localStorage. Records that you acknowledged the cookie banner. Not a cookie itself.

We do not use advertising cookies, tracking cookies, or third-party marketing cookies.

4. Third-Party Services

We share data with the following third parties only as necessary to provide the Service:

  • Google (OAuth + APIs) — We authenticate via Google OAuth and access GA4 and Search Console data through Google's APIs. Google's handling of your data is governed by the Google Privacy Policy.
  • Stripe — Processes all payments. Receives your billing email and organization metadata. Governed by the Stripe Privacy Policy.
  • Cloudflare — Hosts the Service and runs background jobs. Processes web requests, including IP addresses and request metadata. Governed by the Cloudflare Privacy Policy.
  • PlanetScale — Hosts our PostgreSQL database where your account data and synced analytics data are stored. Servers are located in the United States. Governed by the PlanetScale Privacy Policy.

We never sell, rent, or trade your personal information or analytics data to any third party.

5. Data Storage and Retention

5.1 Where Your Data Is Stored

Your data is stored in PostgreSQL databases hosted by PlanetScale in the United States. The Service runs on Cloudflare's global network.

5.2 Raw Data Retention by Plan

Detailed daily GA4 and Search Console data is retained according to your subscription plan:

  • Starter: 90 days (approximately 3 months)
  • Growth: 365 days (12 months)
  • Business: 730 days (24 months)

When raw daily data exceeds your plan's retention limit, it is permanently deleted. Aggregated rollup data (daily, weekly, and monthly summaries) is retained indefinitely for historical trend analysis.

5.3 Account Data Retention

Your account information (name, email, organization membership) is retained as long as your account is active. When you delete your account, all associated data is permanently removed within 30 days, including backups.

6. Your Rights

You have the following rights regarding your data:

  • Access. You can view all your data at any time through the Nook dashboard.
  • Export. You can download a complete JSON export of all your account data, organizations, sites, and analytics data from Settings. The export includes your profile, GA4 data, Search Console data, and daily rollups.
  • Deletion. You can delete your account entirely through Settings. This permanently removes your user record, all organizations you own, all connected sites and their data, all analytics data, and cancels any active Stripe subscriptions. This action is immediate and irreversible.
  • Revoke Google Access. You can disconnect Google at any time. You can also revoke Nook's access directly from your Google Account permissions, which will stop all data syncing.
  • Withdraw Consent. Where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, use the self-service options in your dashboard Settings or contact us at privacy@nookanalytics.com.

7. Google API Services User Data Policy

Nook Analytics's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

  • We only request the minimum OAuth scopes necessary: analytics.readonly and webmasters.readonly. We never request write access to your Google accounts.
  • We use data from Google APIs solely to provide and improve user-facing features within Nook Analytics (displaying your dashboard, computing rollups, generating reports).
  • We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features (e.g., storing it in our database), as required by law, or as part of a merger or acquisition with advance user notice.
  • We do not use Google user data for advertising, retargeting, or interest-based advertising.
  • We do not use Google user data to determine creditworthiness or for lending purposes.
  • Human access to Google user data is limited to what is necessary for debugging, support, and legal compliance, and only with your consent or as required by law.

8. PIPEDA Compliance (Canada)

As a British Columbia corporation, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). Under these laws:

  • Accountability. We have designated a privacy officer responsible for our compliance. Inquiries can be directed to privacy@nookanalytics.com.
  • Consent. We obtain meaningful consent before collecting, using, or disclosing your personal information. You may withdraw consent at any time, subject to legal or contractual restrictions.
  • Limiting Collection. We collect only the personal information necessary to provide the Service.
  • Accuracy. We rely on Google as the authoritative source for your profile information and keep it current through OAuth.
  • Safeguards. We protect personal information with security measures appropriate to the sensitivity of the information, including encrypted connections (TLS), token-based authentication, and access controls.
  • Individual Access. You may request access to or correction of your personal information at any time by contacting us.

9. GDPR Compliance (European Union)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional provisions apply:

  • Data Controller and Processor. You (the customer) are the data controller for the analytics data from your connected properties. Nook Analytics acts as a data processor, processing your data on your behalf and according to your instructions.
  • Legal Basis for Processing. We process personal data based on: (a) performance of a contract (providing the Service you subscribed to), (b) legitimate interests (security, fraud prevention, service improvement), and (c) consent (where applicable).
  • Your GDPR Rights. You have the right to access, rectify, erase, or port your data (Articles 15-20), restrict or object to processing (Articles 18, 21), and lodge a complaint with a supervisory authority. Use the self-service tools in Settings or contact us to exercise these rights.
  • International Transfers. Your data is stored in the United States. For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework.
  • Data Processing Agreement. A Data Processing Agreement (DPA) is available upon request for customers who require one. Contact privacy@nookanalytics.com.
  • Sub-processors. Our current sub-processors are listed in Section 4 above. We will notify you before adding new sub-processors.

10. Data Security

We protect your data using industry-standard measures, including:

  • TLS encryption for all data in transit
  • Encryption at rest for database storage
  • OAuth 2.0 with minimal scopes (read-only access only)
  • Short-lived access tokens with automatic refresh
  • Session-based authentication with IP and user-agent logging
  • Cascading deletion to ensure complete data removal
  • No storage of credit card numbers or sensitive payment details

While we take reasonable precautions, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@nookanalytics.com.

11. Children's Privacy

The Service is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 30 days before the changes take effect and update the "Last updated" date above. Continued use of the Service after the effective date constitutes acceptance of the revised policy. If you do not agree with the changes, you may delete your account before they take effect.

13. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, contact us at:

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada or, for EU residents, your local data protection authority.