Privacy Policy

1. Who We Are & Scope of Service

Sharflow ("we", "us", or "our") operates the Sharflow — AI Website Watchdog platform available at https://sharflow.online. Sharflow is operated by Shariful Islam, an individual operator based in Saudi Arabia.

Sharflow provides automated website health and search performance monitoring. Instead of requiring you to manually check analytics dashboards every day, Sharflow watches performance signals in the background and sends alert briefs only when meaningful shifts, anomalies, or momentum changes occur.

2. Information We Collect

We collect only the information required to deliver automated monitoring, authenticate your account, and operate the platform:

A. Account and Profile Information

• Contact & Account Details: Display name and email address, used as your unique login identifier, for transactional monitoring notifications, and account recovery.
• Password Credentials: Salted and hashed using the industry-standard bcrypt cryptographic algorithm (10 rounds). Plain-text passwords are never recorded, accessible, or stored.

B. Website Monitoring Configuration

• Monitoring Preferences: Primary website URL, site category, monitoring priorities, high-priority pages, tracked competitors (if provided), and notification preferences.
• Operational State: Status flags and timestamps recording when your website was last audited.

C. Connected Datasource Information

• Provider Identification: Connected provider name (Google Search Console, Google Analytics 4, or Bing Webmaster Tools), verified property ID, and property URL.
• Granted Scopes: The list of OAuth permissions granted during the provider authorization step.
• Encrypted OAuth Refresh Tokens: Refresh tokens are encrypted at rest using AES-256-GCM authenticated encryption with a unique 12-byte initialization vector (IV) and authentication tag. Plain-text refresh tokens are never stored in plain text and are never returned to client browsers.
• Account Synchronization Metadata: Associated provider email address and timestamps of the most recent synchronization.

D. Aggregated Performance Metrics

• Aggregated Metric Values: Aggregate counts and averages for search impressions, clicks, click-through rates (CTR), average search positions, sessions, active users, and conversions retrieved via authorized APIs.
• Aggregated Dimensions: Top search query strings and top landing page paths associated with aggregate performance.
• Aggregated Data Focus: Sharflow utilizes aggregated performance metrics provided by connected search and analytics APIs. We do not intentionally request, record, or track individual visitor names, personal profiles, or individual visitor browsing histories from your connected properties.

E. Monitoring Findings and Reports

• Audit Results: Historical records of generated watchdog reports, detected anomaly findings, mathematical baseline shifts, priority-ranked recommendations, and executive summaries.

F. Operational and Delivery Records

• Delivery Telemetry: Scheduler execution timestamps and delivery locks ensuring scheduled monitoring routines execute reliably without duplicate alert dispatches.

G. Temporary OAuth and Security State

• State Verification Tokens: Cryptographically random state and CSRF verification tokens generated during active OAuth connection handshakes, purged after the authorization flow completes.

3. Exact OAuth Scopes Requested

Sharflow requests the following permissions to retrieve search and analytics metrics from your connected accounts:

Google APIs:

• https://www.googleapis.com/auth/webmasters.readonly
  Purpose: Read-only access to Google Search Console performance data (clicks, impressions, click-through rates, average query rankings, and verified property list) to detect organic traffic drops and momentum shifts.
• https://www.googleapis.com/auth/analytics.readonly
  Purpose: Read-only access to Google Analytics 4 reporting data (sessions, active users, and engagement metrics) to assess website engagement trends.
• openid, email, profile
  Purpose: Standard Google Identity scopes used to verify account identity and confirm ownership during the OAuth consent flow.

Microsoft Bing Webmaster Tools:

• webmaster.manage
  Purpose: The official OAuth scope required by Microsoft to communicate with the Bing Webmaster API. Although Microsoft designates this scope as "manage", Sharflow utilizes this access solely to perform read queries for search performance (impressions, clicks, and search query data). Sharflow does not modify your Bing Webmaster settings, submit disavow files, or alter site ownership configurations.

4. Google API Services User Data Policy (Limited Use Disclosure)

In accordance with the Limited Use requirements:

• Specific Use Only: We use Google Search Console and Google Analytics data strictly to provide user-facing website performance monitoring, trend analysis, and alert reports.
• Third-Party Processing & Transfers: We do not sell Google user data, nor do we transfer it to third parties, except as strictly necessary to operate the service (specifically, transmitting encrypted data to our managed database provider MongoDB Atlas for storage and calling server-side Google Gemini APIs to summarize verified findings), comply with applicable laws, or as part of a merger or acquisition with explicit notice.
• No Advertising: We never use or transfer Google user data for serving advertisements, retargeting, personalized marketing, or interest-based targeting.
• No Generalized Model Training: We never use Google Search Console or Google Analytics data to train generalized machine learning or artificial intelligence models.
• Restricted Human Access: No humans read your raw Google performance data unless: (a) you provide explicit consent to resolve a specific technical support issue, (b) it is required for security investigations or legal compliance, or (c) data is aggregated and anonymized for internal system performance auditing.

5. OAuth Token Security & Storage

We employ defense-in-depth measures to secure connected OAuth credentials:

• AES-256-GCM Encryption: All OAuth refresh tokens are encrypted at rest using AES-256-GCM. Each token is encrypted with a unique 12-byte initialization vector (IV) and verified with an authentication tag (iv:authTag:ciphertext) using a secure 32-byte key derived from server environment variables.
• Transient Memory Decryption: Refresh tokens are decrypted in server memory only when automated background routines or on-demand requests query authorized APIs to refresh access tokens and fetch performance metrics.
• Zero Client Exposure: OAuth refresh tokens and client secrets are never included in API responses sent to browser clients and are never written to application logs.
• Encrypted Transport: All communication with Google, Microsoft, and database servers occurs over encrypted HTTPS / TLS channels where technically supported.

6. AI Processing of Verified Findings

Sharflow utilizes artificial intelligence (specifically Google Gemini via the server-side API) to synthesize actionable summaries and explanations from your website's monitoring findings. Our architecture follows a strict verification pipeline:

• Findings Interpretation, Not Data Generation: The AI model does not independently invent raw analytics metrics. Instead, mathematical code algorithms first detect and verify significant baseline shifts (e.g., a sustained drop in clicks, impressions, or keyword positions). The AI is then asked to explain the likely cause and prioritize actionable recommendations.
• Aggregated Findings Input: The AI model receives only the verified findings (such as percentage shifts, query/page scopes, and metric context), your stated website type, and monitoring priorities.
• Credential Protection: Sharflow does not intentionally send passwords, OAuth refresh tokens, or personal account credentials to the AI model.
• Conditional Execution: If code algorithms detect zero anomalies or significant shifts during an audit, the AI API call is bypassed entirely.
• No Generalized Model Training: API requests are processed through commercial API interfaces and are not used to train generalized foundation models.

7. Third-Party Service Providers (Subprocessors)

To deliver the Service, Sharflow relies on third-party cloud infrastructure providers. Because the operator is based in Saudi Arabia while these cloud providers operate globally distributed infrastructure, your information may be processed and stored on servers located outside Saudi Arabia. These providers include:

• Google LLC: Provides OAuth authentication services, Google Search Console API, Google Analytics API, and server-side Gemini AI for intelligence summarization.
• Microsoft Corporation: Provides OAuth authentication and Bing Webmaster Tools API for search performance querying.
• MongoDB, Inc. (MongoDB Atlas): Managed cloud database hosting with encrypted storage at rest for account details, configurations, encrypted tokens, metric snapshots, and reports.
• Vercel, Inc.: Application hosting, serverless execution runtime, and edge network routing.
• Resend, Inc.: Transactional email delivery service used to dispatch alert briefs and account notifications from hello@sharflow.online.

8. Data Retention

Sharflow retains your information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy:

• Account and Profile Information: Retained for the duration of your active account to maintain your monitoring settings, preferences, and service access.
• Encrypted OAuth Tokens: Retained until you disconnect the connected data source via your dashboard or request account deletion.
• Aggregated Metrics and Intelligence Reports: Retained as reasonably necessary to provide the service, compute period-over-period baseline comparisons (such as day-over-day, week-over-week, and multi-week trends), maintain historical audit records, and ensure continuous monitoring continuity. Automated deletion intervals are not currently enforced by the database.
• Operational and Delivery Records: Retained as reasonably necessary to maintain operational reliability, prevent duplicate notification delivery, diagnose technical issues, and satisfy security or legal obligations.

9. Disconnecting Datasources & Account Deletion

You maintain control over your connected accounts and personal information:

A. Disconnecting a Datasource in Sharflow

You can disconnect any integration at any time from your Sharflow dashboard settings. When you initiate a disconnect, Sharflow clears the stored encrypted refresh token and associated property configuration for that provider, preventing further automated queries.

B. Revoking Access Directly with Google or Microsoft

You can also revoke Sharflow's access directly at any time from your provider account settings:

• Google: Visit Google Account Third-Party Access, select Sharflow, and click "Remove Access".
• Microsoft: Visit Microsoft Account Privacy Consent to revoke Bing Webmaster permissions.

C. Account & Data Deletion Requests

To delete your Sharflow account and associated records, email us at hello@sharflow.online with the subject line "Data Deletion Request" from your registered email address. Following verification of account ownership, we will delete your user profile, monitoring configuration, connected datasource records, metric snapshots, and generated reports, subject to any records we are legally required to retain for security or compliance purposes.

10. Privacy Rights

Depending on your location and applicable privacy laws (such as the Saudi Personal Data Protection Law (PDPL) for individuals in Saudi Arabia, the General Data Protection Regulation (GDPR) for individuals in the European Economic Area, or other local privacy statutes), you may have certain statutory rights regarding your personal information, including:

• Access: The right to request confirmation of whether we process your personal data and to obtain a copy of that information.
• Correction / Rectification: The right to request correction or updating of inaccurate or incomplete personal information.
• Erasure / Deletion: The right to request deletion of your personal data, subject to legitimate exceptions under applicable law.
• Restriction & Objection: The right to request restriction of or object to specific processing activities under certain conditions.
• Data Portability: The right to receive personal data you provided to us in a structured, commonly used format where technically feasible.

To exercise any applicable privacy rights, please contact us at hello@sharflow.online. We may require you to verify your identity before processing your request.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: