Security and data

What access the service gets, how tokens and data are stored, and how to delete everything.

A short and honest answer to "what do you do with my data".

What access you grant

Google Analytics: read-only. The analytics.readonly scope cannot change, configure or delete anything in your GA4. It can only read the numbers.
Telegram: the bot only knows your chat id, so it can send messages. It cannot see your other chats.

How data is stored

GA4 access tokens are encrypted with AES-256-GCM and stored only in encrypted form. The encryption key lives separately from the database.
Metrics (sessions, conversions by day and channel) are stored as aggregates. This is not your visitors' personal data: ALERTIS collects no names, emails, IPs or personal identifiers.
Database access is protected by row-level security (RLS): every client sees only their own data.

How to revoke or delete everything

Disconnect Telegram: Settings → Notifications → Disconnect. Reports stop immediately.
Revoke GA4 access: one click in your Google account or via Settings → Integrations. The service instantly loses the ability to read your analytics.
Delete collected data: Settings → Integrations → "Delete my data". Collected metrics, baselines and history are removed irreversibly.

Infrastructure

The service runs on Cloudflare (edge), the database is Supabase (PostgreSQL, EU region). Emails are sent via Resend from the alertis.app domain with SPF, DKIM and DMARC. Full policy: Data policy.