Privacy Policy

Effective October 5, 2026

gsc-cli (the gsc command-line tool) is an open-source program that runs entirely on your own computer. It does not collect, transmit, or store your personal data or your Google data on any server operated by its developer, Piyush Gambhir ("the developer").

1. No data collection

The CLI runs locally on your machine. The developer operates no backend servers for gsc and receives no data from your use of the tool. There is no analytics, no telemetry, no tracking, and no advertising.

2. Google data gsc accesses

When you sign in with gsc auth login, gsc asks Google for these permissions:

  • https://www.googleapis.com/auth/webmasters: view and manage Search Console data for your sites. If you log in with --scope readonly, gsc requests https://www.googleapis.com/auth/webmasters.readonly (view only) instead.
  • openid and email: your Google account's email address and account identifier, so gsc can show which account you are signed in as.

With these permissions gsc can read the Search Console properties you can access and your permission level for each, search performance data (queries, pages, countries, devices, search appearance, dates, clicks, impressions, click-through rate, and average position), URL Inspection results, and sitemaps. With the full scope it can also add and remove properties and submit and delete sitemaps.

3. How gsc uses that data

gsc uses Google data only to perform the commands you run, on your own computer:

  • Search Console data is requested when you run a command and is shown in your terminal, or written to files you choose (for example with -o csv > file.csv or gsc export --out DIR).
  • Your email address and account identifier are saved in your local configuration to label the profile, and shown by commands such as gsc auth status.
  • Changes (adding or removing a property, submitting or deleting a sitemap) happen only when you run the command that makes them. --read-only blocks them.

gsc does not use Google data for advertising, does not sell it, and does not use it to develop, improve, or train AI or machine learning models. The developer cannot see your data, and no one reads it on the developer's behalf.

4. Google API Services User Data Policy

gsc's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Storage & security

Everything gsc keeps stays on your computer:

  • Sign-in tokens are stored in your operating system's keychain (macOS Keychain, Windows Credential Manager, or the Secret Service on Linux), along with the client secret if you log in with your own OAuth client. They go to a plaintext local file instead (secrets.yaml, with owner-only 0600 permissions) only if you choose it, either with --insecure-storage or by confirming gsc's offer when the keychain cannot be used during an interactive login; otherwise a missing keychain stops the login.
  • Configuration lives in ~/.config/gsc-cli/config.yaml (or under GSC_CONFIG or XDG_CONFIG_HOME), readable only by you. It holds profile names, the signed-in email address and account identifier, the granted scopes, the OAuth client ID used, and your default property. For a service account it holds the key file's path, never the key.
  • Search Console data is not kept, except in files you ask gsc to write. gsc export, for example, writes data files and a manifest.json to the directory you name.

Tokens travel only to Google, over HTTPS. gsc never writes them to logs or error messages, never sends them through HTTP redirects, and prints one only when you run gsc auth token.

6. Network connections

The CLI makes outbound network requests only while you run a command, and only to:

  • Google, to sign you in and perform the actions you request: accounts.google.com (the consent page, opened in your browser), oauth2.googleapis.com (tokens and revocation), searchconsole.googleapis.com (the Search Console API), and iamcredentials.googleapis.com when you use --impersonate. With Application Default Credentials or a credentials file, Google's authentication library also contacts the token sources that credential names, such as the metadata server on Google Cloud. During browser login, gsc receives Google's reply on 127.0.0.1, on your own computer.
  • GitHub (github.com release pages, not the GitHub API), when you run gsc update, to find and download the latest release, and for the update notice described below. These requests contain no personal data.

The only background request is the update check: at most once a day, and only when the CLI runs in an interactive terminal, it reads the latest release number from the github.com release page so it can tell you a new version is out. It never runs when the CLI's error output is not a terminal (as for most scripts and coding agents), in CI (when CI is set), or with --quiet, and you can turn it off by setting GSC_NO_UPDATE_NOTIFIER=1 or NO_UPDATE_NOTIFIER=1. The developer is not a party to, and cannot observe, any of these connections.

7. Sharing & third parties

Your Search Console data goes only between Google and your computer. It is never sent to the developer or to any third party. The developer does not sell, rent, or share any data, and the tool integrates no third-party analytics, advertising, or tracking SDKs. Your use of Google Search Console is governed by Google's own terms and privacy policy. If you pass gsc's output to another program, such as a spreadsheet or a coding agent, that program's terms and privacy policy apply to what you give it.

8. Revoking access & deleting data

  • gsc auth logout deletes a profile and its saved tokens from your computer.
  • gsc auth logout --revoke also revokes gsc's access at Google. Google ends that Google account's grant for every client in the OAuth client's project, which signs the account out on every machine and profile using it, so gsc asks before doing it.
  • You can remove gsc's access at any time from your Google Account at myaccount.google.com/permissions.
  • To remove everything, run gsc auth logout for each profile (gsc auth list shows them) so their tokens leave the keychain, then delete the configuration directory (~/.config/gsc-cli/ by default) and any files you exported.

Because the developer never receives your data, there is nothing for the developer to retain or delete: you control all of it.

9. Children

This tool is a developer utility and is not directed at children under 13.

10. Changes to this policy

Any changes will be posted on this page with an updated effective date.

11. Contact

Questions about this policy? Contact Piyush Gambhir at developer.piyushgambhir@gmail.com, or see the contact page.