Six beta integrations. Every other status, named.

Meta Ads

Why it is here. The account iNudge audits, watches daily and can be authorized to adjust, for Meta reviewers while app review completes.

Permissions we request:

pages_manage_ads is optional and used only to create a paused ad for a named Facebook Page after your separate approval. Existing connections need a new Meta grant for that action. Where the connection runs through Facebook Login for Business, our authorize request omits the permission list entirely and the granted set comes from a configuration inside our Meta app rather than from our code. Meta's own consent screen shows you the permission set you are actually granting, and that screen is the authority.

What we read

• Which ad accounts your login can reach: account id, name, currency, account status, the business that owns it, and lifetime amount spent
• Account summary: name, currency, status, lifetime amount spent, business name and timezone
• Campaigns: id, name, status, effective status, objective, daily budget, lifetime budget and start time
• Performance at account, campaign, ad set and ad level: spend, impressions, clicks, CTR, CPC, CPM, frequency, reach, purchase ROAS, actions, action values and cost per action
• The same figures broken out by day, which is the history the daily watch compares against
• Ads and creative: parent campaign/ad-set identity, configured and effective status, tracking and conversion-domain fields, and the creative’s id, name, title, body, CTA, object-story/asset-feed shape, image/video identity, destination tags, thumbnail and Instagram permalink
• The state of a campaign or ad set immediately before a change, and again immediately after, to verify it

What can change, after you approve it

What we never touch: Deleting Meta campaigns, ad sets or ads; changing billing or account settings; uploading customer lists; changing pixel settings; or sending Conversions API events. A new ad is created paused and needs a separate approval to activate. Creating a Page ad does not publish a Page post.

Guardrails, enforced in code

• A budget increase over 300%, which is more than four times the current figure, is blocked before an approval card is ever created
• A budget change over 20% in either direction shows a warning above the approve button, because it can restart Meta's learning
• A rebalance across two different accounts is blocked and fails closed
• A rebalance cannot take the source down to zero. Pausing is a separate, explicit action
• A campaign covered by a lock rule you wrote cannot be paused, and the refusal quotes your rule back to you

Where this stands today. Meta reads and guarded write code exist, but Meta's app review is still in progress. New grants are limited to Meta reviewers and explicitly allowlisted supervised test accounts. Meta is not offered to other beta customers, and its implemented write tools are not a general availability claim.

Google Ads

Why it is here. Search, where the money leaks one query at a time.

Permissions we request:

Google publishes one Ads permission and it covers reading and writing. There is no read-only version to ask for, so read-only is a behavior we enforce rather than a permission we request: the write switch on your connection starts off, and while it is off the change tools are not sent to the model.

Google can carry forward scopes you granted to the same OAuth client in an earlier consent. We store the set Google reports back rather than the set we asked for, so our own record never understates what a stored credential can do.

What we read

Reads stop after 5 pages, and at between 50 and 200 rows depending on the report. When a read is cut short we label it truncated rather than presenting a partial list as the whole account.

What can change, after you approve it

What we never touch: Image, video or non-responsive-search creative, and content changes to enabled ads. Arbitrary Shopping tree creation or rebuilding, and bidding strategy types. Deleting enabled campaigns or enabled ads. Conversion action settings. Budget sharing. Billing.

Guardrails, enforced in code

• The same 300% block and 20% warning as Meta
• A shared budget is blocked in the single-campaign budget path. The separate shared-budget family is released in Production for admitted workspaces, names every affected campaign and checks them again before one field is sent
• A change has to resolve to exactly one connected Google account. If it is ambiguous, iNudge stops and asks
• There is no budget rebalance on Google Ads, and the agent is instructed to say so rather than fake one with two separate writes

Where this stands today. Google Ads is the controlled-beta integration. Its deterministic catalog contains twenty-one rules; twelve apply to ecommerce workspaces and twelve to service workspaces. The connector and audit have Production read evidence. All thirty-two Google action families are released in Production for admitted workspaces. Each change needs that account’s write switch and either approval of the exact change or a current permission for that supported fix. Google Ads campaign status, campaign name and one private daily-budget path have supervised Production write-and-inverse evidence. The other released families do not yet have that same provider-evidence standard. Settings shows which families are released to your workspace.

Google Merchant Center

Why it is here. The product feed behind Shopping, where a bad title costs every impression.

Permissions we request:

Google publishes one Merchant Center permission and it covers reading and writing, the same as Ads. There is no read-only version to ask for, so read-only is a behavior we enforce rather than a permission we request: publishing starts off on your connection, and while it is off no publish tool is sent to the model and the server refuses a publish even if one were proposed.

What we read

• The Merchant Center accounts your login can reach, with their names
• The data sources in an account, so we adopt an existing feed rather than creating a second
• Products already in the account, with their offer ids and attributes
• Item-level issues and per-country approval status, which is what the feed audit reports
• The same product list again after a publish, to confirm what was accepted

Product reads stop after 5 pages of 250. When a read is cut short we label it truncated rather than presenting a partial catalog as the whole account.

What can change, after you approve it

• Publish the built feed. The first publish makes iNudge the PRIMARY data source for that Merchant Center account, which replaces whatever feed supplies your Shopping ads today, and the card says so before you approve. Only products that changed since the last publish are sent. Nothing is published if the build has an error Google would reject.

What we never touch: Bids, budgets or campaigns. Your Merchant Center account settings. Shipping, tax or returns configuration. Deleting a data source. Anything in an account you did not connect.

Guardrails, enforced in code

• Publishing is off by default on the connection, and arming it takes a confirmation
• A first publish also requires typing the word PUBLISH, because it replaces the feed serving your ads
• The feed is rebuilt and revalidated at the moment you approve, so a card drafted against an older catalog cannot publish a feed nobody reviewed
• A build with any error Google would reject cannot be published at all
• Merchant Center accepts items one at a time, so a publish reports each item's outcome and can end partial rather than claiming success

Where this stands today. The connector, reads, catalog import, feed audit, rules and preview are implemented and open to the controlled beta. Publishing stays off until the write switch is armed and the exact publish is approved, and remains under supervised validation until publish, verify and recovery have a complete production evidence pack. If Google refuses to list your accounts at connect time, the screen says so and names it as ours to fix. Implemented code is not a customer-available publishing promise.

TikTok Ads

Why it is here. TikTok campaign structure, performance and deterministic checks for ecommerce and lead-generation accounts.

Permissions we request: There is no permission string in our code to print here. TikTok fixes an app's permission set when it approves the app in its own developer portal, so our authorize request sends no scope parameter at all. That makes this the one row on the page where the honest answer is a name from somebody else's dashboard rather than a literal from ours.

TikTok reports the approved grant as numeric ids and publishes no public id-to-name mapping. We therefore store the complete returned set and compare it with the exact reviewed production fingerprint; missing or additional ids fail closed. We never claim that an individual numeric id means a named permission. The consent screen and TikTok’s developer portal remain the authority on the permission names.

What we read

• Which advertiser accounts your login can reach: advertiser id and name
• Account details: name, currency, timezone and account status. That is a second call, because the account list carries none of them
• Daily performance for the account: spend, impressions, clicks, conversions and TikTok's own attributed purchase value
• The same figures per campaign, with the campaign id and campaign name, day by day
• Typed campaign, ad-group and ad inventory, including configured budgets, delivery status and parent ids
• Available identities, videos and pixels used to verify campaign-creation assets
• Deterministic ecommerce or lead-generation audits at account, campaign and ad-group grain

A day TikTok sends no row for is stored as unread rather than as a zero. TikTok filters days with no data out of the response entirely, so a day with no spend and a day we never read arrive looking identical, and writing zeros there would understate spend and inflate every ratio built on it. A window TikTok answers as partially successful is stored incomplete rather than whole. The purchase value above is what TikTok attributed to its own ads: there is no attribution-window parameter on the reporting endpoint, each ad group carries its own windows, so those figures are not comparable with Meta's and are never labeled revenue.

What can change, after you approve it

• Create a new campaign, ad group and ad in one card, every object paused. The selected identity, video and pixel are read from TikTok when the card is prepared and checked again at approval. TikTok publishes no dry run, so the card says that iNudge checked the draft and TikTok did not pre-validate it.
• Transfer one exact reviewed private MP4 to the selected advertiser. One send, checksum-bound approval, read-only video-ID recovery and no automatic resend. Ads require separate approval.
• Enable or pause one existing campaign after a fresh exact-id read and approval.
• Enable or pause one existing ad group after a fresh exact-id read and approval.
• Enable or pause one existing ad after a fresh exact-id read and approval.
• Change one ad group’s configured daily budget in the advertiser’s currency after caps, rules and approval.

What we never touch: Deleting anything. Editing bids, targeting, schedules, creative, audiences, pixels or Events API settings. Remote media upload is not implemented. One private-library MP4 can be transferred through its own exact-file approval; ad creation then requires a ready advertiser video.

Guardrails, enforced in code

• Writes are off by default globally and per connection
• The complete numeric grant must exactly match the reviewed production fingerprint
• Every target and campaign-creation asset is re-read before the write
• Spending caps, locks and blackout rules are rechecked at approval
• No automatic retry after an uncertain provider reply
• Every successful existing-object write is verified by a provider re-read

Where this stands today. TikTok Ads reads, typed inventory, daily history and the deterministic audit are open to the controlled beta. Status and ad-group budget changes are available only with both write switches on and exact approval. Campaign creation produces paused objects only and requires complete identity, video and pixel evidence. TikTok deletion, bid, targeting and creative-upload writes are not implemented.

Shopify

Why it is here. Your revenue and returns are what turn a ROAS number into a profit judgment.

Permissions we request:

All five are read permissions. read_inventory reads a variant's unit cost, so a product's margin can inform its Shopping feed; the other four cover sales and catalog. We deliberately do not request read_all_orders, the protected permission that would let us list orders older than 60 days, because the reporting gain does not justify the access. Shopify shows you the permission list on its own install screen before you approve it, and a store that granted a wider set at some earlier install keeps that grant: what bounds the reads is the code, and customer identities, addresses, payment details and fulfillment records are not queried. Paid-order eligibility and product quantities after returns or removals are read for the last 28 completed shop-local days to identify bestsellers; only product identities and aggregate paid-order counts enter alert evidence. Raw order and line identities stay in memory.

What we read

• Shop settings: name, domain, currency, plan and timezone
• Daily sales from Shopify's own analytics: gross sales, discounts, returns, net sales, total sales and order count
• Product count
• Order count for a window, and a revenue total summed from the orders themselves
• Canceled order count for a window
• Best-selling products from paid, non-test, non-canceled orders over the last 28 completed shop-local days; incomplete coverage withholds the ranking

The revenue total for a window is a sample and the sample size travels with the figure. Orders are read 100 rows at a time and we follow Shopify's cursor rather than stopping at the first page, up to a budget of 50 pages. Past that the window comes back marked incomplete instead of being passed off as the whole total. When Shopify counts orders and returns none of them, revenue comes back empty with the reason in plain language, never as zero. A day holding an order whose money we cannot read is removed whole and named, from the live total and the stored series alike, so the two never disagree about what a day was worth.

What can change: Shopify is read-only today. It is absent from the list of providers the write switch accepts, so the switch refuses to arm for it, no proposal tool exists, and the code that executes approved changes has no Shopify branch. The only request we send to Shopify that is not a read is the install handshake itself.

What we never touch: Customer names, emails and addresses. Line items. Fulfillment and shipping. Discount codes. No customer, line-item or fulfillment endpoint is called anywhere in our code.

Where this stands today. Your gross margin sets the ROAS a campaign has to clear. Once there are enough measurable returns, that bar is raised by your own return rate rather than by an industry figure. Blended MER joins live Meta spend to Shopify revenue in one number, and it excludes Google Ads spend, which the number says on its face. Merchants can install iNudge from the Shopify App Store; connected stores sync every night.

Google Analytics 4

Why it is here. What the site itself recorded, checked against what an ad platform claims for the same traffic.

Permissions we request:

Read-only by definition. This permission cannot change anything in your property, and Google shows it to you on its own consent screen before you approve.

What we read

• Your GA4 account summaries and the property list under them, so you can pick a property
• Sessions, total users, engaged sessions, key events, ecommerce purchases, purchase revenue and total revenue, by traffic source and medium, day by day
• The same window rolled up by channel group: paid social, paid search, organic search, direct, email and referral

These are the site's own numbers, not an ad platform's attributed figures, and they will not match what Meta or Google Ads reports for the same traffic. That difference is the reason to read both, not an error in either one. A property GA4 reports no currency for comes back with its revenue named as an unknown unit rather than assumed to be dollars.

What can change: Nothing. There is no write permission and no write path.

What we never touch: Audiences, custom dimensions, user-level or demographic breakdowns, and real-time reports. The seven metrics listed above are the whole set we request, and no audience, demographic or real-time endpoint is called anywhere in our code.

Where this stands today. The connector, nightly sync and two live read tools are implemented, Google approved analytics.readonly, and GA4 is open to the controlled beta. Production evidence is pending: no sanitized connect-and-read pack is complete yet. No audit check reads GA4 and no write path exists.

Google Search Console

Why it is here. What people searched to find your site, and the pages they landed on, read nightly and live in chat.

Permissions we request:

This is the read-only variant. It cannot add a site or submit a sitemap even if we wanted it to. Google classes it as non-sensitive, so it needed no verification.

What we read

• The list of your verified sites, so you can pick one
• Search queries and the pages they landed on, with clicks and impressions, day by day

What can change: Nothing. There is no write permission and no write path.

What we never touch: Sitemaps, URL inspection, indexing coverage, mobile usability, Core Web Vitals and rich-result status. Only search queries and pages are read.

Where this stands today. The connector, the two spine tables, the nightly sync and two live agent read tools are built and shipped, and Search Console is open to the controlled beta: a connected site is read every night the same way Meta and Google Ads are, and the agent reads its search queries and pages live in chat. The button stayed closed for a week on the belief that webmasters.readonly needed Google's verification; it is a non-sensitive scope and never did. Production evidence is pending: no sanitized connect-and-read pack is complete yet.