Privacy Policy
This describes what the plugin and this website actually store, where it lives, and how long it stays. It is written against the code rather than from a template, so it is specific — and where something is stored, it says so plainly.
Last updated 13 September 2026
Who this covers
sanity-plugin-seofields is maintained by Hardik Desai, an individual developer. Contact: the contact form. This policy covers this website, the hosted analytics API at /api/analytics, and the customer portal.
It does not cover the open-source Sanity Studio plugin running inside your own Studio. That code runs on your infrastructure and sends nothing anywhere unless you enable the Performance feature, which is the part described below.
Google account data
If you connect Performance analytics, you grant access through Google's OAuth consent screen. These are the scopes requested and what each one is for:
| Scope | Why it is needed |
|---|---|
| openid, userinfo.email, userinfo.profile | To identify which Google account owns the connection, so only that person can manage or disconnect it. |
| webmasters.readonly | To read Search Console clicks, impressions, average position and queries for the sites you have already verified in Search Console. Read-only — nothing is ever submitted or changed there. |
| analytics.readonly | To read GA4 sessions, engagement and landing-page metrics for the property you select. Read-only. |
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, that means Google user data is used only to provide the Performance feature to you, is never sold, never used for advertising, never used to train any machine-learning model, and is never transferred to anyone except as needed to run the service or where the law requires it.
Your Google refresh token — the credential that lets reports run on a schedule without you signing in each time — is encrypted with AES-256-GCM before being written to the database. The encryption key is held as a server environment variable and is not stored alongside the data.
You can disconnect at any time from the Performance tab in your Studio (Manage connection) or from the customer portal. Disconnecting deletes the stored token. You can also revoke access independently at myaccount.google.com/permissions.
What is stored, and for how long
| Data | Retention |
|---|---|
| Licence record — email, licence key, Sanity project IDs, purchase status | Kept while the licence is valid. The licence is perpetual, so this is kept indefinitely unless you ask for deletion. |
| Analytics workspace — Sanity project ID, dataset, owner Google email | Kept until you disconnect Google or ask for deletion. |
| Google refresh token (encrypted) | Kept until you disconnect or revoke access. |
| Hostname → Search Console / GA4 property mapping | Kept until you change or remove it. |
| Cached metric responses | 6 hours, then overwritten. Reduces load on Google's API and speeds up the Studio. |
| Subscription state — status, period end, trial end, purchaser email, Lemon Squeezy subscription ID | Kept while the subscription exists and afterwards as a billing record. |
| Share links | Expire automatically after 7, 30 or 90 days — your choice at creation. Revocable at any time. |
| Email report recipients and cadence | Kept until removed, or until that recipient unsubscribes. |
| Portal sign-in tokens | 10 minutes, single use. Deleted when used. |
| Portal session cookie | 30 days. httpOnly, secure, SameSite=Lax. |
| Studio session tokens | 15 minutes. Short-lived by design — they are not stored server-side. |
| Email log — recipient, subject, timestamp | Kept as a delivery record so support questions can be answered. |
| Contact form and page feedback | Kept until acted on, then retained as a record of the conversation. |
Everything above is stored in MongoDB Atlas. Nothing here is sold, and nothing is shared with advertisers.
Who else touches your data
Running this service means using a few third parties. Each one only receives what it needs:
| Service | What it receives |
|---|---|
| Vercel | Hosting. Receives ordinary request data — IP address, user agent, the page requested. |
| MongoDB Atlas | The database described above. |
| Lemon Squeezy | Payments. They are the merchant of record: your card details go to them and never reach this service. We receive your email, the subscription status and an order ID. |
| Google (Search Console, Analytics Data API) | The connection you authorise. Read-only. |
| SMTP email provider | Delivery of licence keys, portal sign-in links and scheduled reports. |
| Google Analytics and Mixpanel | Anonymous page-view and click events on this website, in production only. Not connected to your licence or your Google connection. |
| Telegram | An operational alert to the maintainer when an email is sent, a contact form is submitted, or page feedback is left. Credentials and sign-in links are stripped before sending. |
How it is protected
- Google refresh tokens and share payloads are encrypted at rest with AES-256-GCM.
- Session and action tokens are HMAC-SHA256 signed, short-lived, and compared in constant time.
- The portal uses an httpOnly, secure, SameSite=Lax cookie, with an origin check on every write.
- Sign-in links are single use and expire in 10 minutes.
- Entitlement is enforced on the server, never in the code shipped to your Studio.
- Card details never reach this service at all — Lemon Squeezy handles payment end to end.
No system is perfect. If you find a security problem, please report it through the contact form rather than publicly, and you will get a reply.
Your choices
You can ask for a copy of what is stored about you, ask for it to be corrected, or ask for it to be deleted. Use the contact form; there is no ticket system to navigate.
Deleting your analytics data removes the workspace, the Google connection, the property mappings and the report recipients. A billing record of past payments is kept, because tax rules require it.
Every scheduled report email carries an unsubscribe link. Clicking it stops that specific address receiving reports, without affecting anyone else on the list.
Cookies
This site sets a session cookie only after you sign in to the customer portal. Analytics scripts run in production and set their own cookies for anonymous usage measurement. There are no advertising cookies and nothing here is used to build a profile of you across other sites.
Children
This is a developer tool sold to businesses and individuals running websites. It is not directed at children, and account data is not knowingly collected from anyone under 16.
Changes
If this policy changes in a way that affects how your data is handled, the date at the top changes and material changes are announced on the blog. Continuing to use the service after a change means you accept the updated policy.
Questions about any of this?
One maintainer, no ticket queue. Ask about anything here — what is stored, how to get it deleted, or what happens to your data if you cancel.
Get in touch