Umami Website Overview Privacy Policy
Effective date: October 9, 2026. This policy applies to the private Umami Website Overview dashboard described on the application information page. It describes this dashboard’s use of Google data, rather than the general visitor privacy practices of every website it monitors.
Data accessed and purpose
With the operator’s authorization, the dashboard reads Google Analytics 4 reporting metrics, including active users, sessions, page views, and key events. It also reads Google Search Console reporting data, including clicks, impressions, click-through rate, average position, and search query reports. These reports are used only to help the operator understand and improve their own websites.
The application requests the Google Analytics read-only and Search Console read-only scopes. The operator specifies which Google Analytics property and Search Console resource the dashboard queries. The application does not request Gmail, Google Drive, payment information, or permissions to modify Google resources.
Storage and access
OAuth client configuration and refresh tokens are stored encrypted in the private Umami database. Access tokens are used to request reports from Google. Reports are displayed to the authenticated dashboard administrator. The dashboard does not intentionally persist the Google report responses as a separate report archive.
The service runs on Hostinger and uses a Supabase-hosted database. These infrastructure providers process information as necessary to host the application and its database. Google processes authorization and API requests. This policy does not claim that these providers’ own operational logs or backups are absent.
Limited use and sharing
Google user data is used only to provide this private reporting dashboard. It is not sold, used for advertising, used to determine creditworthiness, or used to train generalized AI or machine learning models. The application’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revocation, retention, and deletion
The operator can revoke the application’s Google access in their Google Account connections settings. Revocation stops further authorized access but does not automatically erase encrypted credentials already saved in the Umami database. Saved integration configuration remains until removed by the operator; deletion requests can be made through the contact below. Infrastructure backups may retain prior copies under the provider’s backup practices.
Contact for privacy questions or deletion requests: hao1752307774@gmail.com.