Privacy Policy, AI Visibility Tracker

What we store

Data	Why
Your email address	To identify your account and sign you in. Handled by Supabase Auth.
Your API keys	To run tracking on your behalf. Encrypted with a key held only as a server environment variable, never stored alongside the data it protects. Only the last four characters are ever displayed again.
Brands, prompts and competitors you add	To know what to track.
Tracking results	The text of AI answers, the URLs they cited, and the scores derived from them. This is the product.
Run costs	The figures DataForSEO reports for each call, so you can see your own spend.

Cookies and analytics

Two things are stored in your browser. The first is the session token that keeps you signed in; without it the app cannot work. The second is Google Analytics, which counts visits so we know which pages are worth keeping. Analytics sets its own cookies and records your approximate location, device and the pages you view. It is not used for advertising. It runs on the signed-in app as well as the public pages, but the only thing it can see there is the page address, which carries an internal id rather than a name. Your brands, prompts, results and API keys are never sent to it.

If you would rather not be counted, any tracker blocker will stop it, and nothing in the tool breaks when you use one.

Who else sees it

Running a tracking job means sending your prompts to third parties. Specifically:

DataForSEO, receives your prompts and brand names in order to query the AI platforms and Google. Your API credentials authenticate directly with them.
OpenAI and Anthropic, receive the text of collected answers for scoring, if you have added those optional keys. Without them this routing goes through DataForSEO instead.
Supabase, hosts the database and authentication.
Railway, hosts the application.
DuckDuckGo, serves the small site icons shown next to cited URLs. This means DuckDuckGo can see which domains appear in your reports. We chose their service over Google's for that reason.
Google Analytics, counts page views. See the section on cookies above for what it does and does not receive.

We do not sell data, and we do not share it with anyone beyond the processors above.

Where it lives

Data is stored in the United States. If you are in the UK or EU and that matters to your obligations, take it into account before adding client data.

How long we keep it

Until you delete it. Deleting a brand removes its runs, answers and competitor records immediately and permanently: there is no recovery, which is why the app makes you type DELETE to confirm. Deleting your account removes everything associated with it.

Your control

Revoke any stored API key at any time from Settings.
Export your cited-pages data as CSV.
Delete individual brands, or your whole account, without contacting us.
Ask what we hold on you by emailing josh@joshblackburn.co.

Security, stated plainly

API keys are encrypted at rest. Database access is restricted per user. Traffic is over HTTPS. That said, this is a free tool run by a small agency, not a bank, use judgement about what client data you put into it, and use a DataForSEO key you're willing to rotate.

Children

This is a business tool and is not directed at anyone under 16.

Changes

If this policy changes materially, the date above changes and we'll say so in the app.

This policy describes what the software actually does, written by the people who built it. It is not legal advice and has not been reviewed by a lawyer. If you're operating under GDPR, CCPA or a client contract with its own data terms, have someone qualified check it against your obligations.