What Mignard Analytics collects, keeps, and never touches.

Who runs this

Mignard Analytics is operated by Paul Mignard (Mignard Company) at analytics.mignard.co. It measures visits to a small number of websites whose owners have asked for it, watches whether those sites are up, checks them for problems, receives their contact-form messages, and reports on how they appear in Google search. Questions about this policy go to paul@mignard.co.

Visitors to measured websites

The tracking script sets no cookies and uses no browser storage. For each page view it records the page, the referring site, the visitor's country, device type, browser and operating system, and a daily visitor number derived from a salted hash that is thrown away at midnight UTC. IP addresses are used only to look up the country and are never written to disk. Nothing recorded can identify a person or recognise them from one day to the next, and nothing is shared with advertising networks or data brokers.

Messages sent through a contact form on a measured site, including any name, email address or phone number typed into it, are stored so the site owner can read and answer them, and are emailed to the people who manage that site. They are not used for anything else.

People with a login

Site owners and the people they invite sign in with an email address and password. The password is stored as a hash. A session cookie keeps you signed in; it is the only cookie the dashboard sets. We send email about the sites you have access to: alerts, weekly summaries, and leads from contact forms, each of which can be switched off.

Google Search Console data

A site owner can connect a site to Google Search Console. When they do, Mignard Analytics asks Google for read-only access to Search Console data (the webmasters.readonly scope) and nothing else: no Gmail, Drive, contacts or profile information.

With that access we fetch, for the connected property only, search performance reports (queries, pages, clicks, impressions, click-through rate and average position) and URL inspection results (whether Google has a page indexed, and how it sees it). This data is shown to the people who manage that site in their dashboard and weekly email, and a summary of it is stored so the dashboard can show history. It is not sold, not shared with anyone outside the site's own users, not used for advertising, and not used to train any model.

The Google refresh token that keeps the connection alive is encrypted at rest and used solely to make those requests. Disconnecting from the site's setup page revokes the token with Google and deletes it from our database. You can also remove access at any time from your Google account's third-party access page.

Mignard Analytics' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other services

Site checkups send page URLs to Google's PageSpeed Insights API to obtain Lighthouse scores, and the Search tab sends a search phrase such as "drain cleaning in Bend, OR" to Google's Places API to see which local listings Google ranks. Neither request includes any visitor data.

When a person with access to a site presses its Ask for guidance button, a written summary of that page's aggregate figures (visit totals, popular page paths, referring domains, country and device counts, uptime, checkup findings, Lighthouse scores, search targets and the numbers Google reports for them) is sent to Anthropic's Claude API, and the written assessment it returns is shown in the dashboard. The summary never includes visitor hashes, session identifiers, IP addresses or the contents of contact-form messages, and nothing is sent unless the button is pressed. The summary that was sent is stored with the answer so it can be inspected. Anthropic processes these requests under its commercial API terms, which do not permit the data to be used for training its models.

Where the data lives, and for how long

Everything is in one PostgreSQL database on a single server hosted on Railway, in the United States. Visit data is kept for as long as the service runs unless a site owner asks for it to be trimmed after a set number of days. A site owner can export everything about their site as CSV at any time, and can deactivate or delete the site, which removes all of its data. Deleting a login removes that person's access; the sites' data belongs to the sites.

Changes

If this policy changes, the date at the top changes with it, and anything that affects connected Google accounts is announced to the people who manage those sites by email.