Privacy Policy

Effective date: 11 November 2026

This Privacy Policy describes how metricbarn (the "Service", "we", "us") handles personal data belonging to users who sign in to the Service. The Service is a private, internal performance analytics application; access is restricted to authorised team members and is not offered to the general public.

1. Data we collect

When you sign in, we collect only the minimum needed to authenticate you and show personalised reports:

• Email address — used to match your account against the allow-list of authorised users.
• Display name — shown in the dashboard header so you can confirm which account you are signed in with.
• A unique Google account identifier (sub claim) — tied to your session so the Service knows which account the session belongs to.
• Session cookies — one HTTP-only, Secure cookie set on *.metricbarn.xyz to keep you signed in across page loads.
• Technical access logs — IP address, user-agent, request path and timestamp of pages you visit inside the Service, retained for operational monitoring and security.

We do not collect passwords, payment information, contact lists, files, calendar entries, or any other personal data beyond the items listed above.

2. How we use Google user data

The Service uses Google Sign-In (OAuth 2.0 / OpenID Connect) and requests only the following non-sensitive scopes:

• openid — proves the identity of the signing-in Google account.
• email — returns the account's email address.
• profile — returns the account's display name and unique identifier.

We use this data for one purpose only: to authenticate the user against our allow-list and start a signed-in session on the Service. We do not request, read, modify, or store any other Google data — including Gmail, Google Drive, Calendar, Contacts, Photos, or Workspace content. We do not request offline access tokens, and we do not perform any server-to-server calls to Google APIs on your behalf.

3. How your data is used

• To decide whether you are authorised to access the Service.
• To maintain your signed-in session via a session cookie.
• To display your name in the dashboard header so you can confirm your account.
• To produce operational logs needed for security monitoring and incident response.

Your data is never used to serve advertising, is never sold, and is never shared with third parties for marketing purposes.

4. Data sharing

We do not sell, rent, or trade your personal data. We share data only with:

• Our infrastructure providers — the hosting and DNS providers that operate the servers the Service runs on. These providers process data solely for the purpose of operating the Service on our behalf.
• Legal authorities — where required by applicable law or in response to a valid legal request.

5. Data retention

• Session cookies expire automatically after at most 7 days of inactivity; signing out clears the cookie immediately.
• Access logs are retained for up to 90 days for operational monitoring and are then rotated out of storage.
• Allow-list entries (your email) remain for as long as your access is authorised; removal from the allow-list revokes future access immediately.

6. Data security

All traffic to the Service is encrypted in transit via TLS. Session cookies are marked Secure and HttpOnly. Sign-in flows go through Google's OAuth 2.0 endpoints over HTTPS. Access to production infrastructure is limited to a small number of operators using key-based SSH authentication and is network-restricted to allow-listed IP addresses and VPN gateways.

7. Your rights

You may at any time:

• Request that your account be removed from the allow-list (this ends your access).
• Request a copy of the personal data we hold about you.
• Revoke the Service's access to your Google account via your Google Account settings; this immediately prevents the Service from signing you in.

To exercise these rights, email admin@brickin.net.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date at the top of this page. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

9. Contact

For privacy questions, data requests, or security reports, contact admin@brickin.net.