Skip to content
RankGrepDocumentation

Privacy Policy

What RankGrep collects, why, where it is stored, and how to have it deleted.

Updated 17 Sept 20264 min read

On this page
  1. Information we collect
  2. How we use it
  3. AI processing
  4. Google user data
  5. Data sharing
  6. Where your data is stored
  7. Data retention
  8. Security
  9. Your choices
  10. Changes
  11. Contact

Information we collect

  • Account info — your email and name, from Google Sign-In.
  • Websites you add — the URL, name, target country/language, and description you provide.
  • Crawl data — publicly visible page content (titles, meta descriptions, headings, links, word counts) from sites you choose to audit.
  • WordPress connections (optional) — the site URL, username, and an encrypted WordPress Application Password. We never see or store your actual WordPress account password — Application Passwords are a separate, revocable credential WordPress generates for this purpose. Applying fixes also relies on the RankGrep connector plugin installed on your own site, which stores the values RankGrep writes in your WordPress database and sends nothing anywhere on its own.
  • Google Search Console (optional) — if you connect it, read-only search performance accessed via an encrypted OAuth refresh token. This includes the search terms people typed to reach your site, the pages they landed on, and the country and device they used, alongside clicks, impressions and average position.
  • Google Analytics (optional) — if you connect it, read-only traffic figures: sessions, active users, page views, landing pages and traffic channels. RankGrep also stores the names and web addresses of the GA4 and Search Console properties in your Google account, which is how it works out which property belongs to which of your websites.
  • GitHub connections (optional) — the id of the RankGrep GitHub App installation you approve, the account it belongs to, and the repository you chose. No GitHub token is stored; GitHub issues a short-lived one each time RankGrep acts, and removing the installation on GitHub ends access.
  • Rank tracking — the search terms you track for a website and the town or country you chose to check them from.
  • Competitor websites — the addresses of competitor sites you add, and the publicly visible content of their pages, crawled the same way as your own.
  • AI Assistant conversations — the questions you ask the assistant and its replies are stored, so a conversation can be reopened later.
  • Support requests — the messages you send through Help in the app, our replies, and the context attached to a request: which page you were on, which website was selected, your plan, and your data-credit use that month.
  • Billing — which plan you are on, its status and renewal date, and the identifiers Paddle gives your subscription. Card and payment details go to Paddle directly and never reach RankGrep.

How we use it

To run audits, detect issues with real evidence, prepare and — once you approve — apply fixes, and show you real search and traffic performance for websites you’ve connected.

AI processing

Crawled page content, issue evidence, the messages you send the AI Assistant, and search performance figures used as context may be sent to a third-party AI provider (Anthropic, OpenAI, or Google Gemini, depending on configuration) to generate analysis and suggested fixes. We never send your Google account password or WordPress password to these providers — we don’t have them to send.

Google user data

RankGrep’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data sharing

We don’t sell your data. Information is only shared with the third-party services needed to provide the feature you used:

  • Google’s APIs for sign-in, Search Console and Analytics, and Google PageSpeed Insights for performance scores.
  • An AI provider (Anthropic, OpenAI or Google Gemini) for analysis and suggested fixes, as described above.
  • DataForSEO for live ranking checks and backlink data. It receives the search terms you track, the location you chose, and the domain names of your website and any competitors you added — never your account details.
  • GitHub, when you connect a repository: the branch and pull request RankGrep creates contain the change you approved and nothing else.
  • Paddle, which sells and bills the subscription as merchant of record. Paddle receives your email address and handles payment details under its own privacy policy.

Where your data is stored

RankGrep runs on Vercel and stores its data in a managed PostgreSQL database provided by Neon. Both may process and store data on servers outside your own country.

Data retention

Data is kept while your account is active. Removing a website deletes its crawl, issue, repair and AI Assistant history, its performance scores, its rank tracking and competitor data, and its WordPress and GitHub connections. Search Console and Analytics figures already imported are held against the Google property they came from rather than against the website, so removing a website unlinks them but does not delete them. To delete your account and everything associated with it, including those, ask through Help in the app.

Security

WordPress Application Passwords and Google refresh tokens are encrypted at rest. External sign-in uses OAuth or scoped application credentials only — RankGrep never asks for or stores your Google or WordPress password.

Your choices

Disconnect a WordPress, GitHub or Google connection anytime from Connections; a GitHub installation can also be removed from your GitHub settings. Sign out anytime. Request account deletion through Help in the app.

Changes

This policy may change. Material changes will update the date above.

Contact

Questions about this policy: open Help in the top bar of the app and send a support request. We answer there.