Matchstick for agents

Privacy: what a connected client can see

A connected client acts as the person who connected it, on the sites they chose at consent (or that a key was minted for), and sees what that person sees of those sites: Search Console clicks, impressions and positions by page and by query; the crawl's facts about each page; findings and the evidence behind them; changes, their diffs and reviews; weekly reports; and the account's activity trail. It never sees credentials, tokens, other accounts, billing details or the person's sign-in.

Every call is a row on the site's Activity page with the client's name, so the people on the account can see what an agent did. There is no public page of this: nothing about a site is published anywhere. A person revokes a client in Settings → Connected agents (OAuth) or Settings → API keys; revocation ends access immediately.

The data a client receives is subject to its own operator's terms. Matchstick's handling of your data is in the privacy policy; the connection and token design is in security.