Trust and access
Connecting NavSignal means granting it OAuth access to your Search Console and GA4 accounts, and optionally write access to a repository. That is a real ask, so this page answers it plainly: what NavSignal reads, what it stores, what it can change, and what it is built to never do.
What does NavSignal read?
Search Console and GA4 access is read-only: NavSignal requests thewebmasters.readonlyand analytics.readonlyOAuth scopes, nothing broader. Those scopes permit reading impressions, clicks, position, and session data for the properties you choose. Alongside that, NavSignal crawls the pages of the domain you register and pulls keyword data, so it can see what each page actually contains. It never requests write access to Search Console or GA4.
What does it store, and where?
Account and audit data lives in Supabase (PostgreSQL). Row-level security is enabled and forced on the tables that hold it, scoped to your workspace, and every write goes through a service role rather than a client-supplied query. Google and GitHub access tokens are stored encrypted and are only ever decrypted server-side, through one dedicated helper, never sent to the browser. For the full list of subprocessors, the systems we host ourselves, and how long each kind of data is kept, see the Privacy Policy.
Can it change my site?
Only if you connect a GitHub repository, and only by opening a pull request against it. NavSignal never merges that pull request and never writes to your live site directly: review and merge stay yours. It never force-pushes to any branch of yours. The one exception is narrower than that: resuming an abandoned revert attempt can force-update a revert branch NavSignal itself created, never your repository's base or default branch. If you haven't connected a repository, there is nothing for it to write to.
What can it never do?
The repository NavSignal is allowed to write to is checked in code before any GitHub API call is made: it can only be the shared demo repository or the repository your own workspace explicitly connected, nothing else. An environment-level override on our side cannot widen that allowlist; it can only cause a deploy to fail the check, never satisfy it with an unapproved repository.
What happens if a fix is wrong?
Every action brief carries a confidence rating, shown next to the finding, so you can weigh how sure NavSignal is before you act on it. NavSignal proposes a fix as a pull request for you to review; it never merges on your own behalf. If a deployed fix turns out to be wrong, it can be reverted from the deploy history panel. Revert is implemented for the GitHub pull request path, which is the only deploy target available today; other deploy targets are listed as coming soon and are not yet live.
Who operates it?
NavSignal is built and operated by Chalupa Productions LLC, a Texas limited liability company. Questions about access, data, or anything on this page: echalupa@whtnxt.io.