Security
Last updated: 2026-09-03
How Appnaly handles access, tokens and your data.
Read-only scope
We request exactly one Analytics scope: analytics.readonly. There is no code path in this application that can create, edit or delete anything in your Google Analytics account.
Sign-in and Analytics access are separate
Signing in requests only openid, email and profile. The Analytics scope is requested later, in its own consent screen, and only after you press "Connect Google Analytics".
Tokens encrypted at rest
Refresh tokens are encrypted with AES-256-GCM before being written to the database. Access tokens live in server memory only. Tokens are never sent to the browser, never placed in URLs, and never written to logs.
Tenant isolation
Every stored row carries the owning user id, and every query filters on the authenticated session’s user. No API accepts a user id from the client.
No raw end-user event storage
This service stores aggregated counts only. Your app users’ individual events never enter our database.
Transport and headers
Production traffic is HTTPS only, with HSTS, a restrictive Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy applied to every response. Session cookies are HttpOnly, Secure and SameSite=Lax.
OAuth hardening
The Analytics connect flow uses the Authorization Code flow with PKCE, a random state value bound to an encrypted HttpOnly cookie, an exact-match redirect URI, and a session check on the callback.
Disconnect and delete controls
Disconnect revokes the grant with Google and deletes the stored token. Delete account removes every row we hold about you. Both are available in Settings.
Reporting a vulnerability
Please email motionfit.fit@gmail.com with details. We aim to acknowledge reports within a few business days.
Contact
Questions about this page: motionfit.fit@gmail.com