Back to StatPilot

1. Who We Are

StatPilot is a Google Analytics 4 dashboard operated by Dizid Web Development, a sole-proprietorship based in the Netherlands. You can reach us at hello@dizid.com.

2. What Information We Collect

We collect only what is necessary to provide the service.

2a. Information from Google (via OAuth)

When you sign in with Google, Google shares the following with us under the OpenID Connect protocol:

• Your Google account email address
• Your display name
• Your profile picture URL
• A Google user ID (an opaque numeric identifier)

2b. OAuth Tokens

To keep you signed in and fetch your analytics data, Google issues us:

• A refresh token — stored server-side (see Section 4), used to obtain short-lived access tokens without requiring you to re-authenticate.
• An access token — short-lived (1 hour), held in memory during a request cycle and never persisted.

2c. Google Analytics Data

With your permission (via the analytics.readonly OAuth scope), we fetch aggregated metrics from your GA4 properties — such as page views, sessions, and traffic sources. This is your own analytics data; we only read it and display it to you.

Analytics data is not stored on our servers. It is cached in your browser's localStorage with a 6-hour expiry and is never transmitted to us or any third party.

2d. What We Do Not Collect

• No passwords (authentication is entirely handled by Google)
• No payment information
• No behavioral tracking, heatmaps, or session recordings
• No advertising identifiers

3. How We Use Your Information

Data	Purpose
Email address	Verify you are on the authorized access list; display in the dashboard header
Name & profile picture	Display in the dashboard header during your session
Google user ID	Index your refresh token in secure server-side storage
Refresh token	Obtain new access tokens to fetch your GA4 data without re-authentication
GA4 analytics data	Display in your browser; locally cached for performance

We do not use your data for marketing, profiling, advertising, or any purpose other than operating the dashboard for you.

4. Data Storage

Server-side (Netlify Blobs)

Your Google refresh token is stored in Netlify Blobs, a managed object-storage service. Netlify Blobs stores data encrypted at rest using AWS S3 server-side encryption (SSE-AES256). Data is keyed by your Google user ID and is accessible only to our serverless functions.

No other personal data is stored server-side.

Browser-side

• Session JWT — stored in localStorage. Contains your name, email, profile picture URL, and an expiry timestamp (24-hour TTL). Signed with HS256; not encrypted. Cleared when you log out or the token expires.
• Analytics cache — stored in localStorage. Contains your GA4 metrics for faster page loads. 6-hour TTL. Contains aggregated website statistics, not personal information. Cleared when you log out.

5. Cookies

We use exactly one cookie:

• oauth_state — an httpOnly, Secure, SameSite=Lax cookie set during the Google OAuth login flow. It contains a random CSRF-protection token, expires after 5 minutes, and is deleted immediately after sign-in completes. It is never used for tracking or advertising.

We do not use tracking cookies, analytics cookies, advertising cookies, or any persistent cookies beyond the above.

6. Third-Party Services

• Google LLC — provides OAuth authentication and the GA4 Data API. See Google's Privacy Policy.
• Netlify, Inc. — hosts the application and serverless functions, and provides Netlify Blobs storage. See Netlify's Privacy Policy.

We have no other third-party integrations. There are no tracking pixels, advertising networks, or analytics tools embedded in StatPilot.

7. Data Retention

• Refresh tokens — retained in Netlify Blobs until you log out (which triggers deletion) or revoke access via your Google Account.
• Session JWT — expires after 24 hours; deleted on logout.
• Analytics cache — expires after 6 hours; deleted on logout.
• oauth_state cookie — expires after 5 minutes and is deleted immediately after sign-in.

8. Your Rights and Choices

You have full control over your data:

• Revoke access: Visit Google Account → Security → Third-party access and remove StatPilot. This invalidates your refresh token immediately. We will detect the revocation on the next API call and delete the stored token.
• Delete local data: Click "Logout" in the dashboard. This clears the session JWT, analytics cache, and triggers deletion of your refresh token from our servers.
• Data portability: Your analytics data belongs to you and is held in Google Analytics. Export it directly via the Google Analytics interface.
• Requests: For questions or deletion requests, email hello@dizid.com. We will respond within 30 days.

If you are located in the European Economic Area, you may have additional rights under the GDPR, including the right to access, rectify, or erase your personal data. Contact us to exercise these rights.

9. Data Security

We take reasonable measures to protect your data:

• All traffic is served over HTTPS (TLS 1.2+)
• Refresh tokens are stored encrypted at rest (AWS SSE-AES256)
• Session JWTs are signed and have a 24-hour expiry
• The oauth_state cookie is httpOnly and Secure to prevent JavaScript access and CSRF attacks
• Access to the dashboard is restricted by an email allowlist

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children's Privacy

StatPilot is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with their information, please contact us at hello@dizid.com and we will delete it promptly.

11. International Transfers

Dizid Web Development is based in the Netherlands (EU). Your data may be processed by our service providers (Google, Netlify) in the United States and other countries. Where data is transferred outside the EEA, we rely on the service providers' Standard Contractual Clauses or other applicable transfer mechanisms.

12. Changes to This Policy

We may update this policy when the service changes materially. We will update the effective date at the top of this page. For significant changes affecting how we use personal data, we will take reasonable steps to notify affected users. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this privacy policy? Contact us:

• Email: hello@dizid.com
• Web: dizid.com