Tagsmith

Tagsmith sign-in service: terms of use

Last updated:

These terms cover the Tagsmith sign-in relay at https://connect.shivaatripathi.com, which the Tagsmith WordPress plugin uses to connect to your Google account. They do not cover Google, Microsoft or WordPress.org, which have their own terms. The plugin itself is free software under the GPLv2 or later, and its license is in the plugin.

The relay is run by Shivaa Tripathi, called "I" below. By connecting your site through it, you agree to these terms. If you do not agree, use tracking-only mode or your own Google client (see section 6), and the relay is never contacted.

1. What the service does

The relay does one job: it lets a WordPress site sign in to Google without the plugin shipping a Google client secret.

  • When you click "Connect with Google" in the plugin, the relay shows a page that names your site, then sends you to Google.
  • When you approve, Google sends your browser back to the relay with a one-time code. The relay exchanges it for tokens and passes them to your site.
  • Later, your site sends its refresh token to the relay to get a new access token.

The relay never calls the Analytics or Search Console APIs and never sees your analytics data. The privacy policy has the details of what it handles.

2. It is free, and provided as it is

The service is free. I provide it as it is. I do not promise that it will always be available or free of errors, or that it will suit your purpose. If it is down, the plugin cannot connect or refresh its token until it is back, and reports may stop updating. Please keep your own backups and your own copy of anything that matters to you.

Nothing in these terms takes away rights that the law of the place where you live gives you and that cannot be waived.

3. What it stores

Nothing that you could ask to have deleted. The relay has no database. It keeps codes, tokens, email addresses and site addresses in memory only for the length of one request. Its logs record only the route, the response status, the time and how long the request took. It does not log tokens, codes, email addresses, request bodies or query strings. It uses your IP address in memory to limit how many requests one address can make per minute. The privacy policy explains this in full.

4. Your side of it

  • Only connect a Google account, and a site, that you are allowed to connect.
  • Your use of Google's services stays under Google's own terms and the Google API Services User Data Policy.
  • Access is read-only. The plugin can view your Analytics and Search Console data and cannot change it.
  • You can disconnect in the plugin, or remove Tagsmith's access at https://myaccount.google.com/permissions, at any time.

5. Acceptable use

The relay is for the Tagsmith plugin. Please do not:

  • use it for anything other than connecting the Tagsmith plugin to Google;
  • send it a lot of requests, try to get round its rate limits, or otherwise try to overload or disrupt it;
  • try to get the Google client secret out of it, or probe it for weaknesses (if you find a security problem, please tell me instead, see section 8);
  • use it to connect an account or a site that you are not allowed to connect, or to send people to a site that is not yours.

I may block addresses or sites that do any of this, without notice.

6. If you would rather not use it

The relay is optional. In tracking-only mode (you paste a G- Measurement ID) and with your own Google OAuth client (Settings, Sign-in & data), the plugin never contacts the relay.

7. Changes, and the service stopping

I may change or stop the service. I will try to give notice before I stop it, on https://shivaatripathi.com/tagsmith and in the plugin's changelog, but I cannot promise how much. If it stops, tracking-only mode and your own Google client keep working, because they do not use it.

I may change these terms. The "Last updated" date above will change, and I will describe significant changes in the plugin's changelog.

8. Contact

Shivaa Tripathi
Email: [email protected]