Privacy Policy

What RankGrep collects, why, where it is stored, and how to have it deleted.

Updated 29 Oct 20264 min read

On this page

Information we collect
How we use it
AI processing
Google user data
Data sharing
Where your data is stored
Data retention
Security
Your choices
Changes
Contact

Information we collect

Account info — your email and name, from Google Sign-In.
Websites you add — the URL, name, target country/language, and description you provide.
Crawl data — publicly visible page content (titles, meta descriptions, headings, links, word counts) from sites you choose to audit.
WordPress connections (optional) — the site URL, username, and an encrypted WordPress Application Password. We never see or store your actual WordPress account password — Application Passwords are a separate, revocable credential WordPress generates for this purpose. Applying fixes also relies on the RankGrep connector plugin installed on your own site, which stores the values RankGrep writes in your WordPress database and sends nothing anywhere on its own.
Google Search Console (optional) — if you connect it, read-only search performance accessed via an encrypted OAuth refresh token. This includes the search terms people typed to reach your site, the pages they landed on, and the country and device they used, alongside clicks, impressions and average position.
Google Analytics (optional) — if you connect it, read-only traffic figures: sessions, active users, page views, landing pages and traffic channels, and, for visits sent by AI assistants such as ChatGPT, the referring source. RankGrep also stores the names and web addresses of the GA4 and Search Console properties in your Google account, which is how it works out which property belongs to which of your websites.
GitHub connections (optional) — the id of the RankGrep GitHub App installation you approve, the account it belongs to, and the repository you chose. No GitHub token is stored; GitHub issues a short-lived one each time RankGrep acts, and removing the installation on GitHub ends access.
Rank tracking — the search terms you track for a website and the town or country you chose to check them from.
Competitor websites — the addresses of competitor sites you add, and the publicly visible content of their pages, crawled the same way as your own.
AI Assistant conversations — the questions you ask the assistant and its replies are stored, so a conversation can be reopened later.
Support requests — the messages you send through Help in the app, our replies, and the context attached to a request: which page you were on, which website was selected, your plan, and your data-credit use that month.
Billing — which plan you are on, its status and renewal date, and the identifiers Paddle gives your subscription. Card and payment details go to Paddle directly and never reach RankGrep.

To run audits, detect issues with real evidence, prepare and — once you approve, or as your Automation settings allow — apply fixes, and show you real search and traffic performance for websites you’ve connected.

AI processing

Crawled page content, issue evidence, the messages you send the AI Assistant, and search performance figures used as context are sent to OpenAI, our AI provider, to generate analysis and suggested fixes. If OpenAI is unavailable when a request is made, the same request may be sent to Google Gemini or Anthropic instead, as a backup, so the work is not lost. We never send your Google account password or WordPress password to these providers — we don’t have them to send.

Google user data

RankGrep’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We don’t sell your data. Information is only shared with the third-party services needed to provide the feature you used:

Google’s APIs for sign-in, Search Console and Analytics, and Google PageSpeed Insights for performance scores.
OpenAI for analysis and suggested fixes, with Google Gemini and Anthropic as backups when OpenAI is unavailable, as described above.
DataForSEO for live ranking checks, backlink data and AI recommendation checks. It receives the search terms you track, the location you chose, the domain names of your website and any competitors you added, and the questions you choose to track, which it puts to ChatGPT, Perplexity, Gemini and Claude on RankGrep’s behalf — never your account details.
GitHub, when you connect a repository: the branch and pull request RankGrep creates contain the change you approved and nothing else.
Paddle, which sells and bills the subscription as merchant of record. Paddle receives your email address and handles payment details under its own privacy policy.

Where your data is stored

RankGrep runs on Vercel and stores its data in a managed PostgreSQL database provided by Neon. Both may process and store data on servers outside your own country.

Data retention

Data is kept while your account is active. Removing a website deletes its crawl, issue, repair and AI Assistant history, its performance scores, its rank tracking and competitor data, and its WordPress and GitHub connections. Search Console and Analytics figures already imported are held against the Google property they came from rather than against the website, so removing a website unlinks them but does not delete them. To delete your account and everything associated with it, including those, ask through Help in the app.