Privacy

What we collect

When you run an audit: the domain you entered, publicly available information we fetch from that website (page title, meta description, robots.txt, llms.txt, favicon), the questions we generated, and the answers AI assistants returned. All of it is public information about a public website.

If you give us your email: the address, the domain it was submitted with, and the timestamp — so we can send you your report and tell you when tracking becomes available.

If you join a waitlist: the address, which plan you picked, an optional domain, and the timestamp. We use it once — to tell you the plan exists. There is no drip sequence and no newsletter.

Automatically: your IP address is used transiently for rate limiting and is not stored alongside your audit. Standard server logs are kept briefly for operations and security.

If you have an account

Accounts exist only for paid tracking — the free audit never needs one. If you make one we store your email address, the domains you asked us to track, and the results of each scheduled scan (score, how many answers named you, how many cited you, and the rival names that appeared). That scan history is the product: it is what lets us show you a line rather than a dot.

There is no password. You sign in with a link we email you, so there is no password for us to store or for anyone to steal. The sign-in link and your session identifier are both stored only as one-way hashes — if our database were ever copied, it would contain no usable sign-in.

What we don’t collect

No passwords. No payment card details, ever — see below. No tracking or advertising cookies. No analytics scripts that follow you elsewhere. We never ask for access to your website, your analytics, or any private system.

Cookies

Two, both strictly necessary, neither used to track you. A session cookie set when you sign in, so the site knows it is you — it is removed when you sign out. And the cookie Cloudflare’s captcha sets while checking that a form submission came from a person. Because neither is used for analytics or advertising, there is no consent banner to click through.

Payments

Paid plans are sold through Paddle, who act as merchant of record. You pay them, on their page, and no card details ever reach us — we receive only the fact that a subscription started, changed or ended, plus an identifier that links it to your account. Paddle handles the payment data under its own privacy policy.

How long we keep it

Reports: 30 days, then automatically and permanently deleted. Email addresses are kept until you ask us to remove them.

Scan history: for as long as you track the domain. Deliberately longer than the 30-day report retention — the history stores only the numbers, not the full report, so a trend line survives even after the reports behind it have been deleted. Remove a tracked domain and its history goes with it. Close your account and everything goes.

Who else sees it

To produce a report, the questions we generate are sent to the AI assistants we query (currently OpenAI, Anthropic, xAI, Perplexity, and DataForSEO for Google AI Overviews), under their own terms. Our hosting provider (Fly.io) and our network provider (Cloudflare) process traffic on our behalf. If we email you, that is sent through Resend. Paid subscriptions are processed by Paddle. Account and tracking data is stored in a managed Postgres database hosted by Neon in Frankfurt, Germany (EU). Nobody buys, rents or receives your data for their own purposes.

Report links

Each report has a long, randomly generated address. It isn’t indexed by search engines and can’t be guessed — but anyone you send the link to can open it. Treat it like any shareable document.

Your rights

If you’re in the EU/EEA or UK, the GDPR gives you the right to access, correct, export, or delete your data, and to object to how we use it. In practice: email [email protected] and we’ll action it. Deletion requests are honoured within 30 days, usually the same day. Our lawful basis is legitimate interest for running the audit you requested, consent for the email you chose to give, and performance of a contract for anything tied to a paid subscription.

Contact

[email protected] — for anything on this page, including having your data removed.