Privacy

This page describes what the product stores and what it sends elsewhere. It is written from the code rather than from a template, so it is specific and it is short.

What an account holds

• Your email address. If you sign in with Google we also store the stable account identifier Google gives us — never the address as the key, so changing it at Google does not strand your account — and the display name Google reports, when it reports one.
• A session, stored as a one-way hash of the session identifier rather than the identifier itself, so a copy of our session table cannot be replayed as a live sign-in.
• What you put in: the sites you analyse, the rivals you compare against, the keywords you track and the tags you put on them, the prompts you measure, your notes and your drafts.
• What is fetched on your behalf: keyword, ranking and backlink data, the pages a crawl reached, the answers language models gave to your prompts, the daily clicks, impressions and positions Search Console reports for your site, the sessions and revenue Analytics reports, your store’s posts and products, and where product listings appear for the queries you track.
• A grade, when you grade a post against the pages that rank for a keyword: the keyword and market it was asked in, the letter and the score, and what it was scored on — the addresses of the top-ranking pages that were read, their median word count and the heading terms they share. To score it the product reads each of those public pages’ title, headings, word count and description length, and that answer is cached with the other provider responses described below.
• A record of each paid lookup — which endpoint, what it cost and which workspace asked — because that record is how a plan’s budget is counted.
• Every address you invite into a workspace. That address belongs to somebody who has not signed in, agreed to anything or read this page, and it is held because you asked us to let them in. It is deleted when the invitation is accepted or withdrawn; one that is left to expire stops working and its row stays.
• Every address a sign-in link is requested for, with a one-way hash of the link and when it was asked for, used and due to stop working. The sign-in form behaves the same for an address with an account and one without, so that nobody can use it to find out who has one — which means a row is written for any address typed into it, including the address of somebody who has never signed in. The link stops working once it is used or once it expires; the row stays, and nothing in this product removes it.
• Whether you have hidden the workspace home’s setup checklist. That is kept against your account rather than in your browser, because it is your choice rather than the screen’s. If you dismissed the setup steps a project’s dashboard used to show, that earlier choice is still stored too, though nothing in the product reads it any more.
• For each connected Google account, the address and the account identifier of the account that connected it — stored as ordinary text beside the encrypted credential. The identifier is what makes re-connecting the same account update it in place instead of leaving a second copy, and the address is what names the connection on screen so you can tell two of them apart. Neither is what refreshes the connection: that is the encrypted credential’s job. Either may belong to a different person, and a different address, from the one that signs in.

It stores no IP address. Nothing in this product reads the address a request came from, and no table has a column to put one in. Cloudflare, which serves every request, sees them the way any host of any website does.

What a message through the contact form holds

The list above is about accounts, and somebody who writes in through the contact form has none — so this is what that form stores: the name, the email address, the topic and the words you send, and the moment the message arrived. Nothing else about it is recorded, and in particular nothing about the network it came from: that address is neither stored nor read. The one thing the form does look at is the site your browser says the submission was posted from, where it says anything at all, and that is compared with this one and then discarded.

The message is stored before anything tries to send it on, so a failure in the mail cannot lose it. It is then sent to the address at the end of this page, through Resend, which the third-party section below names along with everything else it carries.

A message is kept until somebody asks for it to be removed. There is no form for that and no button: write to the same address and say so, which is how a copy, a correction and a removal all work here. The sentence further down about removing an account is about accounts, and a message from somebody who has never signed in is not in one — so this is the sentence that covers it.

Diagnostic logs

When something goes wrong the product writes a line to its own server log, and some of those lines name a connected Google account’s address — a disconnection, for instance, logs the workspace and the address so that a report of lost data can be matched to the event that caused it. Those logs are held by Cloudflare, which runs the product, under whatever retention that platform applies; they are not a feature anybody can read from inside the product, and no part of them is forwarded anywhere else.

What is kept in your browser

These public pages set no cookie at all. There are two inside the product, and the first of them arrives earlier than you might expect: a session cookie is set the moment you begin signing in — pressing Continue with Google sets one before Google has even asked you anything, because the state that makes that round trip safe has to be remembered somewhere — and it lasts a year, so an attempt you abandon leaves one behind. The second is whether you asked for the light or the dark theme, kept in the browser rather than against your account because it belongs to the screen you are reading on rather than to you — unlike hiding a setup checklist, which the list above keeps against your account.

Signing in with Google

Choosing Google sends you to Google and asks for Google’s standard sign-in scopes — the ones that identify an account, give its address and give basic profile information such as a name and a picture. Google’s own consent screen is where you see that list before you agree to it.

What this product then keeps is narrower than what it asked for: your account identifier, your address, and your display name when Google reports one. It is the identifier that your account is keyed on, never the address, so changing your address at Google does not strand it. Whether Google says the address is verified decides which account a sign-in belongs to and is not stored. Nothing else from the profile is stored — a picture and a locale arrive with the rest of it and nothing keeps them, which is a narrower thing to say than that they are never looked at, and it is the true one.

That is a separate thing from connecting Search Console or Analytics below: those grant read access to data, they are asked for separately, and neither signs anybody in.

Third parties, and what each one is for

Keyword, ranking, crawl, backlink and product-listing data is fetched from DataForSEO, and so are the pages a grade reads. Answers to AI visibility prompts are requested through OpenRouter, which passes each prompt on to the language model you chose — what that model’s provider then does with it is governed by their terms and not by this page. Payments are handled by Stripe, which means card details are entered on Stripe and this product never receives them. Email is sent through Resend, and there are four kinds of it: a sign-in link, an invitation to a workspace, the weekly summary of what moved, and a message you send through the contact form, which reaches us rather than you.

All of it runs on Cloudflare, which is also where the database holding every row described above lives, and where the provider responses this product caches are stored.

If you connect Google Search Console, Google Analytics or a Shopify store, we read the data you authorised and store the access credential encrypted and bound to your own workspace, so a copy of one workspace’s row cannot be opened for another. Disconnecting removes the credential and leaves the measurements already taken.

What we do not do

• There are no advertising or analytics scripts on this site, and no page of it fetches anything from another company’s server. Nothing you read here is reported to a third party.
• We do not sell what you put in, and we do not train anything on it. What we cannot speak for is a language model provider you chose to send a prompt to, which is why the paragraph above names them separately rather than folding them into a promise.
• Cached answers to public questions — how a domain ranks, for instance — are shared between customers, because the question and the answer are public either way. Anything scoped to a workspace is stored under that workspace and is never served to another one.

Asking for a copy, a correction, or removal

All three work the same way, and it is the way described here rather than a feature on a screen: write to the address below and ask. There is no export of your own account data and no self-serve form for any of it — the project exports are a different thing, and they are a plan feature rather than a right.

Email hello@rankgap.app and ask, and the account and everything in it is removed. There is no button for this: it is a manual process, and saying so is more useful than implying otherwise.

Cancelling

Cancelling a subscription deletes nothing and disconnects nothing. Once it takes effect the workspace is read-only, as the terms describe, and everything already collected stays readable — but a connected Search Console or Analytics property goes on syncing its daily figures into it until you disconnect it. Removal is the separate request above.