Privacy Policy

Last updated 1 September 2026

The short version

We store the email address you sign up with, the websites you connect, the credentials you give us to publish to them, the articles we write for you, and, if you connect them, your Search Console data and the answers AI engines give to the questions we track. We do not collect information about your customers or your website’s visitors. There is no advertising, there are no tracking pixels, and nothing is sold to anyone.

What we collect

Account data

Your email address, and the account and membership records that link it to your projects. Authentication is passwordless: we send a one-time link and never create, store, or see a password.

Project data

The domain you track, your brand name and aliases, the competitors you name, your category, and the description of your buyer that you write during onboarding. That buyer description is used verbatim inside the questions we ask, so do not put anything confidential in it.

Content and publishing data

The pages we read on your site to learn its voice, the keywords and calendar we plan, every article and image we write for you with its scorecard and edit history, and the address of each published post. When you connect a content platform we store the credential you give us for it (a WordPress application password, a Shopify custom-app token, a Ghost admin key, a Webflow, Wix, Notion or Framer token, or an OAuth token from WordPress.com or Google) in our database, encrypted at rest. It is used only to publish and update your articles, to read the posts already there, and to test the connection. Revoke it on the platform or delete the connection in Rankli and it is gone.

Search Console data

If you connect Google Search Console we ask Google for one permission, read-only access to Search Console (webmasters.readonly), and hold the token Google issues for it. With it we read the list of sites your Google account can see, so you can pick yours, and for the site you pick we store daily clicks, impressions, average position and the search queries and pages they came from. That is what the product measures your articles against, shown to you on the Results and Improvements screens. We never write to Search Console, and we read nothing else in your Google account.

Data from Google APIs is used only to show you those reports and to choose which of your articles to improve. We do not sell it, share it with anyone else, use it for advertising, or use it to train AI models. Rankli’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnect it in Settings and the token is deleted; you can also revoke access at any time from your Google account’s security settings.

Measurement data

For every question we ask, we store the full text of the engine’s answer, the sources it cited, and what we extracted from that answer: which brands were mentioned or recommended, in what order, and how much of each cited source appeared in the wording. This is the product; it is also the largest thing we hold about you.

Billing data

Stripe holds your payment method. We store only a Stripe customer identifier, your plan, and your subscription status. Card details never reach our servers.

Operational data

Standard server logs from our hosting provider, including IP addresses and request metadata. We do not run analytics or advertising trackers of any kind.

The free analysis, which needs no account

Anyone can enter a domain at /analyze without signing up. We store the analysis itself, the pages we read, the voice we measured, the keywords and the calendar, against that domain for 24 hours, so a second person asking about the same site is answered without fetching it again. It is derived entirely from pages the site publishes to anyone.

To keep that open door from being abused we also count runs, for an hour by requester and a day by domain. The requester is recorded as a salted hash of the IP address, never the address itself: counting repeats is the only thing the limit needs, and a hash is enough for it. Nothing about a free analysis is attached to an account, and signing up afterwards starts a fresh analysis of your own site rather than adopting that one.

What leaves our systems when we write and measure

Writing means sending the pages we read on your site, your brand description and each article’s brief to our model provider, Anthropic, which returns the article. Publishing means sending the finished article to the platform you connected. Measuring means sending your tracked questions to third-party AI providers. Those questions contain your brand name and your competitors’ brand names, because that is what makes them the questions your buyers actually ask. Assume anything in a tracked prompt is disclosed to OpenAI, Perplexity, Google and Anthropic, subject to their own terms and data retention. We send no account identifiers, no email addresses and no billing data with them.

Where a provider returns a citation without usable text, we may fetch that public page to score how much of it shaped the answer. We identify ourselves as RankliBot and fetch only pages an AI engine already cited.

Subprocessors

Where it lives

In a Postgres database hosted by Supabase in AWS us-east-2 (Ohio, United States). Access between accounts is separated at the database level, and every read the application makes is filtered to your account.

How long we keep it

Measurement history is kept for as long as your account exists, because comparing a round against an old baseline is the entire point of the product. If you cancel, we downgrade the account rather than deleting your history, so you can come back to it. Ask us to delete it and we will, within 30 days.

Your choices

• Ask for a copy of everything we hold about you, in a machine-readable form.
• Ask us to correct anything that is wrong.
• Ask us to delete your account and its measurement history.
• Stop measurement at any time by pausing or deleting a project.

Email hello@rankli.io and we will act within 30 days. Depending on where you live you may have additional statutory rights; we will honour them.

Security

Traffic is encrypted in transit. Data is encrypted at rest by our database provider. Payment credentials never touch our infrastructure. Authentication has no password to steal. We will tell affected customers about a breach that puts their data at risk, without waiting to have a complete story first.

Children

Rankli is a business tool and is not directed at anyone under 16.

Changes

If we change this in a way that materially affects what we do with your data, we will email you before it takes effect rather than quietly changing the date at the top.

Questions: hello@rankli.io · Rankli, 1011 East 5th St, Austin, TX 78702, United States · Terms of Service · Back to Rankli