Privacy
Mugpipe Signals
This page is the privacy policy for Mugpipe Signals. It describes Signals as it runs today, including the Google connection Signals uses.
Last updated: November 11, 2026.
Controller: Mugpipe, privacy@mugpipe.com
The Mugpipe privacy policy is the platform and account policy.
Google data Mugpipe accesses
Sign-in and the Search Console and Analytics connection are two separate Google consents.
Sign-in asks Google for openid and email only. Mugpipe uses the email address and Google's account id to open the Mugpipe account. That sign-in does not request Search Console or Analytics, and it does not request a refresh token.
The Search Console and Analytics connection requests these scopes:
https://www.googleapis.com/auth/webmasters.readonlyhttps://www.googleapis.com/auth/analytics.readonly
That request also asks Google for offline access, so Google can return a refresh token, and it asks Google to show the consent screen. The same Google client is used for sign-in. Google can therefore also show openid and email on the data consent if those were already granted. Mugpipe does not request a scope that edits Analytics, Search Console, the site, or ads.
analytics.readonly is the read scope used to list the GA4 properties on the Google account and to run the Analytics reports below. The edit and manage Analytics scopes are not requested.
With those scopes, Signals reads the Search Console sites and GA4 properties the Google account can see. For the site and property you choose, it reads search clicks, impressions, click-through rate, average position, queries, pages, and the other breakdowns a tool asks for, plus sitemap status and URL inspection. Analytics reports include sessions, users, engaged sessions, key events, and screen page views, by channel, source, medium, landing page, or page path when that tool asks for the breakdown. Signals does not change the Google property.
How that data is used
Signals uses the Google data to answer the tool the AI app called: a list of properties, or the report for the dates and breakdown in that call. The Search Console site URL and GA4 property id you choose are saved on the Mugpipe account so a later call can use them.
Who receives it
The report is returned to the AI app you allowed to call Signals. That is the app that registered with Mugpipe, such as Claude, ChatGPT, or Cursor. Mugpipe does not choose the model, and it does not send the report to a separate analytics product.
The service runs on Cloudflare. The account, the encrypted Google refresh token, the saved site and property, the monthly usage counter, the trial or subscription row, and the audit row are stored in Cloudflare's database. The AI app's grant is stored in Cloudflare Workers KV. Google receives the read request, because that is how the report is fetched.
Mugpipe Signals uses Cloudflare Workers Logs for short-lived error and operational records. Cloudflare processes those records on Mugpipe's behalf. They are used to operate and fix the service. They are not sold. They do not include access tokens, refresh tokens, email addresses, or Google Search Console or Analytics report data.
If you check out, Polar is the seller of record. Polar receives the account email and the account id so the payment can be matched to the account. The card stays at Polar. Mugpipe stores Polar's customer id. The account also stores whether the Signals trial has been used and when it ends. Mugpipe does not sell this data.
How it is protected
The Google refresh token is encrypted with AES-GCM before it is written to the database. The encryption is tied to the Mugpipe account id. The key is a worker secret and is not stored in that database.
The AI app's access token and refresh token are not stored as the raw token. Workers KV stores a SHA-256 id of the token and an encrypted copy of the account information on the grant. An access-token record is kept with a one-hour expiry. The AI app refresh token is set to expire after 30 days.
Each tool call writes an audit row with the tool name, the time, the outcome, the units used, and the host of the AI app. The audit row does not include the tool arguments or the Google response. Report bodies are not written to the database. The browser session cookie holds the Mugpipe account id for 14 days. It does not hold the Google token.
How long it is kept, and how to remove it
There is no page and no API in Mugpipe that deletes the account or the Google connection.
Removing Mugpipe from the Google Account permissions makes the next refresh fail, so new Search Console and Analytics reads stop. The encrypted refresh token row is still in the database after that. Connecting Google again replaces that encrypted token. The saved site URL and property id stay until a later choice overwrites them.
The account email, Google account id, usage counter, trial record, subscription row, and audit rows have no expiry in this application. Nothing in the product deletes them on a schedule. The auth worker can remove expired AI-app grants from Workers KV, but that step is not on a schedule in the current deployment, so this page does not say those grants are cleared on a clock.
This application does not delete Cloudflare's database backups. A backup, if Cloudflare keeps one, is outside the deletion steps in this product. Today the product does not remove the encrypted token row when Google access is revoked.
Error and operational logs in Cloudflare Workers Logs are kept for up to 7 days. More detail is on the data retention page.
Questions and deletion requests: privacy@mugpipe.com. Sending that email does not itself delete the account. Deletion would be a manual change to the database, and this product has no routine that performs it.
Retention periods for each kind of data are listed in the data retention policy. Availability and support targets are on the service availability page.