Security & Trust

Plain answers to the questions people ask before connecting a Google account or paying. Everything on this page is verifiable — nothing is marketing.

Contents

1. How the Google connection works

We use the official Google Business Profile APIs, connected through Google's own OAuth consent screen with the business.manage scope.
Our OAuth application has passed Google's app verification — you will not see an "unverified app" warning when connecting.
We never see or ask for your Google password. Google shows you the consent screen; you approve or decline.
You can revoke our access at any time, without contacting us, at myaccount.google.com/permissions. Revoking immediately cuts our ability to act on your profile.
Details of exactly which data the scope covers are in our Privacy Policy (section 4, Google Limited Use disclosure).

All payments are processed by Paddle.com Market Ltd acting as Merchant of Record. Paddle is the seller on your invoice and handles VAT/sales tax.
Your card number never touches our servers. Card and wallet data is collected and stored by Paddle only.
Refunds are issued through Paddle back to your original payment method — see the Refund Policy for the exact rules and timelines.

Application data is stored on Supabase (managed PostgreSQL), with per-tenant row-level security: one customer's account cannot read another's data.
Your reviews, replies, and photos live on Google, not with us. What we hold are synced working copies used to render your dashboard.
We deliberately do not archive your photos. Photos you publish are hosted by Google; scheduled photos are stored only until they are posted, then our copy is removed by a daily cleanup job.
Account deletion is self-serve from Settings. It removes the stores, reviews, photos, and settings we hold. What you already posted to Google stays on Google, untouched.

A fair question to ask any small vendor. The honest answer is that the design keeps the blast radius small:

Your Google Business Profile is not hostage. Reviews, replies, photos, and business info live on Google and remain exactly as they are. Nothing needs to be exported or migrated.
You can disconnect unilaterally at myaccount.google.com/permissions — no cooperation from us required.
Billing is held by Paddle, an independent Merchant of Record, which processes refunds under its own published rules even if we are unreachable.
There is no long-term contract: Pro is billed monthly and can be cancelled from the dashboard, and the Free plan costs nothing.

We never ask for your Google password. Ever. The only connection path is Google's own OAuth screen.
We never promise to delete reviews. Google does not allow businesses to remove reviews at will. We analyse policy-violating reviews (spam, profanity, fake) and help you file reports with Google — the decision is always Google's.
We never post fake reviews or gate reviews, and our review-request tools tell you not to offer incentives — that is Google policy.
We never publish a reply without your approval or consent. Reply drafts wait for your approval. The only exception is automatic posting on Pro, which the account owner has to turn on in Settings with explicit consent: it covers only reviews written after it was turned on (never reviews that were already there), holds back drafts that may promise money, marks every reply it posts, and can be turned off at any time. The one other thing that runs on its own is a photo you explicitly scheduled, at the time you chose.

Free replies are put together by our own software from a library of prepared sentences; the review text is not sent to any outside provider to make them.
Pro replies and review analysis (removal checks) are generated with Anthropic's Claude models. For these, the review text is sent to that provider to produce the result.
Drafts are shown to you, and nothing is posted until you approve it — unless you have turned on automatic posting (see section 5).
Draft generation is capped per plan and enforced on the server, so a runaway client cannot burn your quota.

All traffic is encrypted in transit (HTTPS/TLS).
Passwords are stored only as salted hashes by our authentication provider (Supabase Auth) — we never see plain-text passwords.
Tenant isolation is enforced with PostgreSQL row-level security; subscription and usage limits are enforced server-side, not in the browser.
Found a vulnerability? Email [email protected] — reports go straight to the founder and are answered.

AHA REVIEW is founder-operated software. Questions about anything on this page are answered directly by the founder: [email protected].