Depends on the service. Google allows us to invalidate the token when we're done, rendering it useless, so we do. You'll notice that if you run the stats tool again you'll have to re-authorize it for Google.

Microsoft does not, so it will remain valid. We don't store it or log it anywhere, and the system that retrieves and processes data is not publicly accessible.