Privacy policy

Who this policy covers

This policy describes how Code Ruleset, operated by Franko Solomun at coderuleset.com, handles information from visitors, authorized workspace users and connected services. It covers Google sign-in and the optional Google integrations described on our application home page.

Google data we access and why

• Sign-in identity: Google returns an identity token containing your email address and email verification status. We use the verified email to check workspace access, identify the owner of connections and establish your session. Basic sign-in requests the OpenID and email permissions.
• Analytics: when you connect Analytics, we request its read-only permission. We discover accessible accounts and properties and retrieve reports for your selected GA4 property, including traffic totals, page paths, acquisition sources, devices, events and engagement metrics.
• Search Console: with its read-only permission, we discover accessible sites and read performance data such as queries, pages, countries, devices, clicks and impressions. Requested diagnostics can include URL inspection and indexing information for that site.
• Google Ads: with the Google Ads permission, we discover customer and manager account identifiers and read Keyword Planner results for your submitted keywords, language and locations. Results can include keyword ideas, search volumes, competition and bid estimates. Although the Ads permission is broad, our integration uses it for these reporting features and does not create, edit or delete campaigns.
• Google Cloud: with the Cloud read-only permission, we discover accessible project identifiers and names and retrieve enabled APIs and services for the project you select.
• Authorization and connection information: we process OAuth authorization codes and tokens, store the refresh credentials needed for later requests, and retain your selected resource identifiers, project labels, connection status and timestamps.

Each service is connected separately after your consent. Offline access allows the server to refresh access when you or an authorized agent requests a report, without asking you to sign in for every request. These integrations do not request Gmail or Google Drive permissions.

How we use Google data

We use Google data to authenticate authorized users, retrieve and display the selected reports, return reports to explicitly authorized agents, cache results, diagnose connection failures and protect access. Connections and report access are associated with their workspace owner.

We do not sell Google user data or use it for advertising, profiling for advertisements, credit decisions or training general-purpose AI or machine-learning models. Google integration reports are not automatically sent to the application’s Gemini chat or rule-generation features.

Code Ruleset’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Sharing and access

Google receives the requests needed to authenticate you and provide the Google features you choose. Our hosting and database infrastructure process information to operate and secure the application.

If you create an agent token and configure it in a coding assistant or another tool, that tool can receive reports from the connections you selected until the token expires or you revoke it. New connections are not added to existing tokens automatically. The receiving tool may process returned information under its own settings and privacy policy. Grant this access only to tools you intend to receive those reports.

Other than the transfers needed for features you authorize, Google data is shared only when necessary for security or to comply with applicable law. Human access is limited to the data you authorize a person to view, necessary security investigations, or legal obligations. We do not provide Google data to advertising networks or data brokers.

Storage, security and cookies

Provider credentials, temporary Google authorization payloads and cached integration reports are encrypted on the server using authenticated encryption. The encryption key is separate from the stored records. Connection labels, resource identifiers, owner email addresses and operational access records are stored as application metadata. Agent tokens are stored as hashes.

The production website uses HTTPS. Necessary cookies maintain sign-in and protect OAuth flows. The signed session cookie contains your email and issue time and lasts up to 30 days. Login verification cookies last up to 10 minutes, and Google integration flow cookies last up to 15 minutes. These cookies are HttpOnly and use the Secure flag over HTTPS.

Retention and deletion

Saved connection metadata and refresh credentials remain until the connection is removed. Report caches have freshness periods, generally one hour for Analytics, Search Console and Cloud reports and 24 hours for Ads keyword research. Cache expiry stops reuse of an old report, but does not by itself guarantee immediate physical deletion. Stored reports are replaced or cleaned up during later activity and are deleted from the active database when their connection is removed.

Temporary Google connection flows expire after 15 minutes. Completed and cancelled flows are deleted. Expired abandoned flows are cleaned up when a new connection flow starts.

Recent-access records contain action names, timestamps, outcomes and connection or agent identifiers, not full report contents or credentials. Records older than 90 days are removed during subsequent integration activity. These records can remain after a connection is removed.

You can request deletion of remaining personal records, including access records and any retained copies, by emailing frankosolomun067@gmail.com from the account concerned. We may need to verify ownership before responding. Where a legal obligation requires retention, we will explain the applicable limitation.

Disconnecting and revoking access

• In Integrations, use Disconnect and confirm Delete connection to delete the saved connection and its cached reports from the active application database.
• Use Revoke under Agent access to stop a particular tool from retrieving further reports. This does not erase reports already received by that tool.
• Visit Google Account connections to remove the application’s Google authorization. Deleting the connection inside Code Ruleset does not itself revoke the grant at Google. Revoking at Google does not itself delete previously stored application records.
• Clear this site’s cookies to end the session in your browser. Contact the operator to request removal of your workspace access or remaining stored information.

Other workspace information

Information you submit to the coding rulebook, review-learning features, shipment tracker or timesheet tools is processed to provide those features. If you use AI chat or AI-assisted rule drafting, the messages, images or code you submit to that feature are sent to Google’s Gemini service for a response. A coding agent receives integration reports only through the separate access you grant it, as described above.

The shipment tracker sends tracking numbers to the relevant tracking services. When AI shipment features are configured, status text is sent to Gemini for classification or explanation. If WhatsApp notifications are configured, the configured phone number and shipment update, including its label or tracking number, status, location and event time, are sent through CallMeBot to deliver the notification.

Public coding guidance is separate from private integration reports. Do not add confidential account information, credentials or personal report data to guidance intended for public distribution.

Questions and changes

Contact frankosolomun067@gmail.com to ask about access, correction or deletion of your information. This policy will be updated when data practices change, with the revised date displayed above. Any new Google permissions must be authorized through Google’s consent process.