Privacy Policy

Account information. When you sign in with Google, we receive your email address, name, and profile image from Google — nothing else about your Google account.

Search Console data. When you connect a property, we request read-only access to Google Search Console (the webmasters.readonly scope) and pull the search queries, page URLs, positions, impressions, clicks and countries it reports for that property. We never request write access, and we cannot change anything in your Search Console account.

Rankings we check ourselves. On paid plans, we run live Google searches (via DataForSEO — see Section 3) to verify a keyword's actual position from a specific country, and store the result.

Billing information. If you subscribe to a paid plan, Stripe collects and processes your payment details directly. We never see or store your card number — we only receive your subscription status and plan from Stripe.

Usage data. We record which features you use and how much of your plan's allowance you've used, to enforce plan limits and improve the product.

Analytics. We use Google Analytics and Google Tag Manager across tranck, including inside the signed-in dashboard, to understand how the product is used. This records standard web-analytics events (pages viewed, rough location, device/browser type) tied to a browser identifier, not to the content of your Search Console data.

• To show you rankings, opportunity scores, and trends across the countries you choose.
• To run the checks and analyses your plan includes — verified rank checks, SERP feature detection, content-gap analysis, competitor tracking, cannibalization detection.
• To send the emails you've opted into — rank-drop alerts and the weekly summary — and essential account/billing notices you can't opt out of.
• To enforce the limits of your plan and calculate usage-based billing.
• To detect abuse and keep the service running reliably for everyone.

We do not sell your data, and we do not use your Search Console data to train any AI model.

We share the minimum each of these services needs to do its job, and nothing else:

• Google — to authenticate you and read Search Console data you've authorized.
• DataForSEO — receives a keyword, a country, and your domain to run a verified rank check on paid plans. It does not receive your Search Console data.
• Anthropic — if you run content-gap analysis (Pro/Agency), your page's text and the text of the competitor pages it's compared against are sent to Anthropic's Claude API to generate the analysis.
• Resend — delivers the emails described in Section 2, and receives your email address and the content of that email to do so.
• Stripe — processes payments if you're on a paid plan; see Section 1.
• Vercel and Neon — host the application and its database. All data described in Section 1 is stored with Neon.

We disclose information if required by law, or to protect the rights, property, or safety of tranck, our users, or the public.

• Your Google refresh token — the credential that grants ongoing Search Console access — is encrypted at rest (AES-256-GCM), not stored in plain text.
• There are no passwords to steal: sign-in is Google OAuth only.
• Sessions are stored server-side and can be revoked; we don't rely on a long-lived token sitting in your browser.
• Every request is scoped to your own account — the database queries behind every page and API route are written so one customer's data is never reachable from another's session.
• All traffic is served over HTTPS.

No system is perfectly secure, and we don't claim ours is exceptional — we do claim to take it seriously and to keep improving it. If you find a problem, we'd genuinely rather hear about it from you first — see Section 11.

We keep your data for as long as your account is active. If you disconnect a property from the Sites page, everything under it — pages, keywords, rank history, alerts, reports — is deleted immediately, and we tell Google to invalidate our access to it rather than just deleting our own copy.

You can delete your entire account yourself, anytime, from Settings — this immediately revokes our Search Console access at Google, cancels any active subscription, and permanently deletes every site, keyword, rank history, alert and report tied to your account. It cannot be undone.

• Disconnect any property at any time from the Sites page — this is immediate and permanent.
• Turn off rank-drop alerts and the weekly summary independently, from the Alerts page.
• Revoke tranck's access at the source, anytime, from your Google Account's third-party access settings — this works even if you don't touch tranck at all.
• Delete your entire account yourself from Settings — see Section 5.
• Request a copy of your data by contacting us.

We use one essential cookie to keep you signed in — the app does not function without it. We also use cookies set by Google Analytics and Google Tag Manager (Section 1) for product analytics. We do not currently show a cookie-consent banner; if you're in a jurisdiction that requires opt-in consent for analytics cookies, you can disable them by blocking third-party cookies in your browser, which does not affect sign-in.

tranck and the providers listed in Section 3 operate primarily in the United States. If you're accessing tranck from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our providers operate.

tranck is not directed at children, and we don't knowingly collect information from anyone under 16. If you believe a child has provided us information, contact us and we'll remove it.

If we make a material change to this policy, we'll notify you by email or with a notice in the app before it takes effect. The date at the top of this page always reflects the latest version.

Questions, data requests, or a security concern you'd like to report privately: privacy@tranck.com.