Privacy Policy

1. Introduction

Qav ("we", "our", or "us") operates the web analytics platform available at theqavtable.com(the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information

When you create an account, we collect your email address and, optionally, your full name.

Google Search Console Data

If you choose to connect your Google Search Console account, we access the following data on your behalf using the webmasters.readonly scope:

Search query keywords and rankings for your verified properties
Click, impression, CTR, and average position data
Your Google account email address (to identify the authorized account)

This data is read-only. We never modify, delete, or write data to your Google Search Console properties. Your Google OAuth tokens are stored securely and used solely to retrieve your site's search performance data and display it within your Qav dashboard.

Website Analytics Data

If you install our tracking script on your website, we collect visitor behavior data including page views, sessions, traffic sources, device types, and geographic regions. This data is aggregated and associated with your site configuration.

PostHog Data (OAuth Connection)

If you choose to connect your PostHog account via OAuth, we access the following on your behalf using the scopes project:read, organization:read, and query:read:

The list of PostHog projects and organizations you belong to (so you can pick which project to connect)
Your selected project's public API key (phc_...) used to render the tracking snippet
Event data read via HogQL queries, solely to compute the dashboard metrics you see (pageviews, unique visitors, top pages, referrers, retention, etc.)

This access is read-only. We never modify, delete, create, or export events in your PostHog account. PostHog OAuth access tokens and refresh tokens are stored encrypted at rest and are used solely to query your analytics on your behalf. You can revoke our access at any time from your Qav dashboard or directly from PostHog under Account Settings → OAuth applications. You may also continue using Qav with a personal API key instead of OAuth; in that case we store only the key you provide.

Payment Information

Payments are processed by Stripe. We do not store credit card numbers or payment details on our servers. We retain subscription status and billing history for account management purposes.

Usage Data

We collect information on how the Service is accessed and used, including log data such as your IP address, browser type, pages visited, and time spent on pages.

3. How We Use Your Information

To provide, operate, and maintain the Service
To display your Google Search Console data within your dashboard
To generate AI-powered insights about your site's performance
To send you optional daily email analytics reports (only if you opt in)
To process payments and manage your subscription
To respond to support inquiries
To improve and develop new features

We do not sell your personal data or Google Search Console data to third parties. We do not use your Google data to serve advertisements.

4. Google API Services User Data Policy

Qav's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we confirm that:

We only use Google user data to provide and improve the features visible to the user within the Qav dashboard.
We do not transfer Google user data to third parties except as necessary to provide the Service.
We do not use Google user data for advertising purposes.
We do not allow humans to read your Google data unless you have given explicit permission or it is required for security/legal purposes.

5. Data Retention

Analytics data is retained according to your subscription plan. OAuth tokens (Google Search Console and PostHog) and any personal API keys you provide are stored until you disconnect the respective integration from your Qav dashboard or delete your account. You may revoke access at any time:

Google: Google Account Permissions
PostHog: Account Settings → OAuth applications (revokes access and refresh tokens immediately)

6. Data Security

We implement industry-standard security measures including encrypted storage of OAuth tokens, HTTPS-only transmission, and access controls. However, no method of transmission over the Internet is 100% secure.

7. Third-Party Services

We use the following third-party services to operate Qav:

Supabase — database and authentication
Stripe — payment processing
Anthropic (Claude) — AI-powered insights generation
PostHog — event tracking and analytics backend (via OAuth or your personal API key)
Google Search Console — search performance data (via OAuth)
Vercel — hosting and infrastructure
Resend — transactional email delivery

Each of these services has its own privacy policy governing their use of data.

8. Your Rights

You have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Disconnect Google Search Console at any time from your dashboard settings
Disconnect PostHog OAuth or remove your personal API key at any time from your dashboard settings
Opt out of email reports at any time

To exercise any of these rights, contact us at hello@theqavtable.com.

9. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy, contact us at: hello@theqavtable.com