Security and data handling

Read-only by design

We only ever read; the app never writes to your store, your product feed, or your Merchant Center account. There is no code path in the product that modifies any of them. Google’s Merchant API has a single OAuth scope, which Google labels read/write — there is no read-only scope to ask for. So “read-only” is a promise our code keeps rather than one the grant enforces: the only Merchant API calls in RevenueCue list and get your accounts, products and reports, and nothing else may hold an access token.

The free scan

A free scan reads only what your store already publishes to the open web — the product listing, the sitemap and the product pages any shopper or search engine can fetch. No credentials are involved, and nothing is accessed that is not already public.

The Google scope, and what it is for

• https://www.googleapis.com/auth/content — the Merchant API’s one scope. We use it to list your Merchant Center accounts, read product statuses and item issues, and read your last 30 days of clicks and conversions, so each leak is priced from your own data.

We never request billing, Ads, Search Console or account-management scopes, and we never write through the one scope we do hold.

How credentials are stored

OAuth tokens are encrypted at rest with AES-256-GCM before they touch the database. They are decrypted only in memory, only to make the API call they were issued for. Credentials never appear in logs, error reports, or API responses; our logs carry scan ids, store domains, counts and error classes only.

Revoking access

Revoke RevenueCue at myaccount.google.com/permissions and it takes effect straight away, regardless of what we do: the next scan falls back to the public catalogue and the store shows “Reconnect Merchant Center”. Reconnecting or changing account replaces the stored token in place. To have a stored token or your whole workspace deleted, email support@tantra-gyan.com and we do it within 30 days.

If your store blocks our scanner

Some stores sit behind Cloudflare or a similar firewall that challenges automated requests. When that happens we are turned away before we can read anything, and the scan says so rather than guessing at a result.

We identify ourselves honestly on every request, obey your robots.txt, fetch at most four pages at a time, and never try to disguise the scanner or work around a challenge:

RevenueCueBot/1.0 (+https://revenuecue.co/bot)

The bot’s own page covers what it reads and how to block it.

A scan fetches robots.txt, the product listing (Shopify’s /products.json or WooCommerce’s Store API), the sitemap, and a sample of up to 40 product pages, or up to 250 from the sitemap when a store has no public listing. You have two ways forward:

• Connect Merchant Center. We read your real feed and price each leak against your own clicks, and no firewall is involved for that part. The public-catalogue checks still need to reach the storefront.
• Allowlist the scanner in Cloudflare. Expressions below.

Cloudflare: the exact rule

In the Cloudflare dashboard go to Security → WAF → Custom rules → Create rule, paste the expression below, and set the action to Skip with Bot Fight Mode, Managed Rules, and Rate Limiting ticked.

Recommended. Allows requests carrying our User-Agent. A User-Agent can be spoofed by anyone, so this is only ever a way past bot protection to pages that are public anyway:

(http.user_agent contains "RevenueCueBot")

Narrower. Scoped to the catalogue endpoints. This lets the product listing through but not the sitemap or the product-page sample, so checks that need those pages report the affected pages as unchecked:

(http.user_agent contains "RevenueCueBot" and (http.request.uri.path eq "/products.json" or starts_with(http.request.uri.path, "/wp-json/wc/store/")))

Adding to a rule you already have. If you already run a skip rule for verified bots and link previewers, add our clause with or:

(cf.client.bot) or (http.user_agent contains "WhatsApp") or (http.user_agent contains "RevenueCueBot")

Only add this on a store you control or have been asked to manage. Once the rule is live, re-run the scan — it takes effect immediately.

We will not attempt to bypass bot protection on any store, including one you tell us you own. A firewall exists to be respected, and a tool whose whole premise is trustworthy numbers does not get to sneak past the front door.

Data retention

• Scan results are kept so your shareable link keeps working, and so the closure ledger can show change over time.
• Ask us to delete your account and we remove your workspace data within 30 days.
• We keep no benchmarks and no aggregate dataset built from your catalogue: every figure shown to you is computed from your own store and nothing else.

Reporting a vulnerability

Email support@tantra-gyan.com with the subject line “Security”. We will acknowledge within 24 hours on business days. Please give us a reasonable window to fix an issue before disclosing it publicly.