Developers like to imagine the hard part of building something new is the code. We can report that, at least once this year, the hard part was a form.
Here’s what happened: to show a merchant their own Google Analytics numbers inside yoursignalstack, we first needed Google’s permission to ask for that data at all — not permission from the merchant, who’s obviously free to connect whatever they like, but from Google itself, as the company deciding whether to trust us with it for anyone. Getting that permission meant going through Google’s own formal review process before a single real merchant (as opposed to our own test accounts) could connect their Google Analytics.
Why does an app need Google’s permission just to show you your own data?
Because the connection isn’t really just between you and the app. It’s a three-way relationship, and Google is the party in the middle deciding whether to hand your information to a given piece of software — not just for you, but as a blanket decision that applies to every merchant who might ever connect that app. Before Google will let an app ask a wide group of real users for that kind of access, it reviews the app first.
That review isn’t a courtesy step. It’s the actual gate between “we built a feature that reads Google Analytics” and “a real store owner can click connect and have it work.” Until it clears, the feature can exist perfectly well in testing and still be unusable for anyone outside our own accounts.
What does that review actually check?
In plain terms: exactly what data is being requested, why the app needs it, and whether the request is as narrow as the stated purpose allows. An app asking to read your analytics numbers gets looked at differently than one asking to also edit your account settings or see unrelated data it has no real use for — the specific list of permissions involved (what the industry calls “scopes,” for anyone who stumbles on the term) has to match the app’s actual job, not just be requested broadly “in case it’s useful later.”
The review also looks at how the data is handled once it’s in the app’s hands: whether there’s a real privacy policy, whether the stated use matches what the app is actually built to do, and whether the request is read-only or something broader. None of that is a formality you can rush through by filling out a form correctly — it takes real back-and-forth, and real time, before Google is satisfied enough to let an app ask ordinary users for that access.
What should you take from this the next time an app asks to connect to your Google account?
You’ve probably seen the screen this produces: the one that lists, in plain language, exactly what a piece of software is asking to see or do on your Google account, with an Allow button at the bottom. Most people click through it fast. It’s worth actually reading, for two reasons.
First, that screen is a direct, unfiltered list of what the app will be able to touch — not marketing copy, not a summary, the actual permissions. If a tool that’s supposed to show you analytics numbers is asking for access to edit your ads or your site content, that’s worth pausing on. Second, if you ever see a warning that says Google hasn’t verified an app, that’s not a glitch — it means the app hasn’t (yet, or ever) gone through the review described above. That’s not automatically a reason to refuse it, especially for something small and early-stage, but it is a reason to look harder at who built it and what it’s actually asking for before you click through.
Why this matters to you
Next time any tool asks to connect to your Google Analytics, Google Ads, or similar account, actually read the permission screen before clicking Allow. Check whether it’s asking for read-only access to the specific thing it needs, or something broader than its stated purpose would explain. And if you see an “unverified app” warning, don’t treat it as background noise — it’s Google telling you this particular app hasn’t been through the review process we just went through, which is worth knowing before you decide whether that’s fine or not. It’s a small habit, it takes about ten extra seconds, and it’s the same check we’d want a merchant to run on us.