Security and data handling

Read-only, always

RevenueCue has no write access to anything. There is no code path in the product that modifies your store, your product feed, your Merchant Center account, or your ad account. We request read-only scopes, and a write scope would be rejected at review even if we asked for one.

The free scan

A free scan reads only what your store already publishes to the open web — the same catalogue data any shopper or search engine can fetch. No credentials are involved, and nothing is accessed that is not already public.

Google scopes, and what each is for

• Merchant Center (content, read-only) — reads your product feed, item issues, and click data so we can tell you which disapprovals actually cost you money.
• Search Console (webmasters.readonly) — reads query and page performance so we can find organic demand your catalogue is not answering.
• YouTube Analytics (readonly) — reads video performance, only if you connect a channel.

We request the narrowest scope that answers the question. We never request write, billing, or account-management scopes.

How credentials are stored

OAuth tokens are encrypted at rest with AES-256-GCM before they touch the database. They are decrypted only in memory, only to make the API call they were issued for. Credentials never appear in logs, error reports, or API responses.

Revoking access

Disconnect a source from your account settings and we delete the stored tokens immediately. You can also revoke independently of us at myaccount.google.com/permissions, which takes effect straight away regardless of what we do.

If your store blocks our scanner

Some stores sit behind Cloudflare or a similar firewall that challenges automated requests. When that happens we are turned away before we can read anything, and we tell you so rather than guessing at a result.

We identify ourselves honestly on every request and never try to disguise the scanner or work around a challenge:

RevenueCue-Scanner/1.0 (+https://revenuecue.co/security)

You have three ways forward, in the order we would pick them:

• Connect Merchant Center. Best option regardless — we read your real feed, every estimate becomes a measured figure from your own clicks, and no firewall is involved.
• Allowlist the scanner in Cloudflare. Expressions below.
• Upload a product export. Export your catalogue from your admin and send it over — we run the same rules against it.

Cloudflare: the exact rule

In the Cloudflare dashboard go to Security → WAF → Custom rules → Create rule, paste the expression below, and set the action to Skip with Bot Fight Mode, Managed Rules, and Rate Limiting ticked.

Recommended. This scopes the exception to the two catalogue endpoints we actually read. A User-Agent can be spoofed by anyone, so tying it to those paths means a forged request gets nothing but your public product feed rather than a way past your bot protection on the whole site:

(http.user_agent contains "RevenueCue-Scanner" and (http.request.uri.path eq "/products.json" or starts_with(http.request.uri.path, "/wp-json/wc/store/")))

Simpler, but broader. Allows anything sending our User-Agent anywhere on your site. Easier to read, weaker protection:

(http.user_agent contains "RevenueCue-Scanner")

Adding to a rule you already have. If you already run a skip rule for verified bots and link previewers, add our clause with or — the IP list here is an example, keep your own:

(cf.client.bot) or (http.user_agent contains "WhatsApp") or (http.user_agent contains "Pinterest") or (http.user_agent contains "RevenueCue-Scanner" and (http.request.uri.path eq "/products.json" or starts_with(http.request.uri.path, "/wp-json/wc/store/"))) or (ip.src in {203.0.113.10 203.0.113.11})

Only add this on a store you control or have been asked to manage. Once the rule is live, re-run the scan — it takes effect immediately.

We will not attempt to bypass bot protection on any store, including one you tell us you own. A firewall exists to be respected, and a tool whose whole premise is trustworthy numbers does not get to sneak past the front door.

Data retention

• Scan results are kept so your shareable link keeps working, and so we can show change over time.
• Delete your account and we remove your workspace data within 30 days.
• Anonymised, aggregate benchmarks may be retained. These can never identify a store.

Reporting a vulnerability

Email support@tantra-gyan.com with the subject line “Security”. We will acknowledge within 24 hours on business days. Please give us a reasonable window to fix an issue before disclosing it publicly.