Sarmug Privacy Policy

About this policy

This Privacy Policy explains how Sarmug (https://sarmug.com) collects, uses, stores, shares and deletes information when you use the Sarmug website, workspace and connected services.

Information we collect and use

We process account details such as your name, email address, profile and preferences; brand and connected-account details; content, media, schedules, campaign activity and reports; and information you provide in support or deletion requests. Authentication is handled through Firebase Authentication. Subscription and payment information is processed through our billing service and payment provider.

We use this information to provide account access, manage your workspace, publish content you authorize, display reports, process subscriptions, provide support, and diagnose errors and protect the service. If you use AI content generation, your submitted prompts and relevant brand information are sent to the configured AI service to generate the requested content.

Google Analytics 4 and Google Search Console

Connecting Google is optional and uses Google's OAuth authorization screen. Sarmug requests your Google email and profile information, read-only Google Analytics access (analytics.readonly), and read-only Search Console access (webmasters.readonly). These permissions let Sarmug identify the connected account, list accessible Analytics accounts and properties, select a GA4 property, and retrieve reporting data. They do not let this integration change your Analytics configuration.

Reports include traffic, users, sessions, page views, engagement, key events, traffic sources, pages, geography, devices, and demographic breakdowns when available from Google. Search Console reporting uses authorized sites and search performance data such as queries, pages, clicks, impressions, click-through rate and position. Sarmug uses these Google data to provide the reporting features you request in your workspace.

We store Google OAuth access and refresh tokens, connection metadata and selected property identifiers on the server so Sarmug can retrieve reports without asking you to sign in to Google each time. Sarmug does not receive your Google password. Report results are returned to your authenticated workspace and may be included in reports you choose to export.

Exact Google OAuth permissions

Permissions depend on the feature you connect. The application requests the following scopes across its Google OAuth flows:

• openid, email and profile: Firebase Google sign-in identifies and authenticates your Sarmug account.
• https://www.googleapis.com/auth/userinfo.email: identify the email address of the Google account connected to an integration.
• https://www.googleapis.com/auth/userinfo.profile: display the connected account’s name and profile information.
• https://www.googleapis.com/auth/analytics.readonly: list Analytics accounts and properties and retrieve read-only GA4 reports.
• https://www.googleapis.com/auth/webmasters.readonly: list Search Console sites and read search performance reports.
• https://www.googleapis.com/auth/youtube.upload: upload videos you authorize to your connected YouTube channel.
• https://www.googleapis.com/auth/youtube.readonly: identify your channel and retrieve channel and video information for management and reporting.
• https://www.googleapis.com/auth/yt-analytics.readonly: retrieve YouTube Analytics reports for your channel and videos.
• https://www.googleapis.com/auth/business.manage: list and select Google Business Profile accounts and locations and manage business posts and performance reports you request.

YouTube data can include channel identifiers, titles, thumbnails, video metadata, subscriber and view counts, and available audience and engagement metrics. Google Business Profile data includes account and location identifiers, business details, posts and available performance metrics. We use these data for the connected publishing and reporting features, store connection identifiers and OAuth tokens on the server, and may retain retrieved metrics in workspace reports. Uploaded video content is transferred to YouTube when you request publication. To delete retained YouTube or other Google data, contact privacy@sarmug.com; revoking authorization alone does not remove previously saved reports.

Google API Services and Limited Use

Sarmug's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

See the Google API Services User Data Policy. Google user data is used for the connected features described here. It is not sold or used for personalized advertising. Transfers are limited to providing those features with your consent, security, legal requirements, or a business transfer with prior explicit consent as required by that policy. Human access is limited to your consent, security investigations, legal obligations, or permitted aggregated internal operations.

Website analytics and browser storage

The Sarmug application includes a Google Analytics tag to measure use of Sarmug itself. This is separate from connecting your own GA4 property. The tag can send page and interaction information and browser or device information to Google and use analytics cookies. Browser storage is also used for sign-in persistence and workspace preferences. You can manage cookies and site storage through your browser settings; restricting storage may affect sign-in and other features.

Storage and security

Workspace records and Google connection credentials are stored in server-side Firebase/Firestore storage. Uploaded media uses configured storage services. Information also exists in your browser while you use the application and in files you export. Hosting and service providers process data as needed to operate the platform; processing locations depend on those providers and the deployment configuration.

The application uses authentication, tenant authorization checks and OAuth state validation to restrict access to workspace data. The public service uses HTTPS. No service can guarantee absolute security. Please protect your account credentials and contact us if you suspect unauthorized access.

Sharing and service providers

Data is processed by providers used to deliver the features you use, including hosting, Firebase authentication and storage, Google APIs, connected social networks, payment processing, email delivery and AI content generation. Content is sent to connected platforms when you instruct Sarmug to publish it. Google reporting data is retrieved for your workspace; it is not an input to the GA4 integration's AI content-generation workflow. Exports you download or share are under your control. Each connected provider also applies its own privacy policy.

Retention and disconnecting Google

Account and workspace records remain stored until removed through an available feature or a deletion request is processed. Google connection tokens are kept to support the connection. Disconnecting Google in Sarmug removes the stored tokens and clears the brand's Google connection metadata; it does not delete your Google account, Analytics property, data held by Google, or copies of reports already exported.

You can also revoke Sarmug's access in your Google Account connections. Revocation stops future authorized access but does not itself erase information already stored in Sarmug. Request deletion separately. We do not specify an automatic purge deadline for all stored records or backup copies in this policy; contact us for the scope and timing of a deletion request, including any records that must be retained.

Your choices, rights and deletion requests

You can choose whether to connect Google, disconnect integrations, update available profile and workspace settings, and request access, correction, export or deletion of your information. Depending on your location, you may also have rights to object to or restrict processing and to complain to a data protection authority.

Send privacy or deletion requests to privacy@sarmug.com using your account email. Identify the account or workspace and whether you want Google connection data or the entire account deleted. Do not send passwords or access tokens. We may need to verify your authority over the account before handling a request. Ask us about any retained records and the expected completion time.

Children and policy updates

Sarmug's terms require users to be at least 18 years old. If you believe a child has provided personal information, contact us. Updates to this policy will be published on this page with an updated date.

Contact

Sarmug — https://sarmug.com
Privacy and deletion: privacy@sarmug.com
Legal inquiries: legal@sarmug.com