Privacy policy

GravitySEO ("GravitySEO", "we", "us") runs a rank tracking and keyword research tool built on Google Search Console and Google Ads Keyword Planner, and is the controller of the personal data described in this policy. You can reach us about anything in it at maxwinterleinweber@gmail.com.

We collect only what the features you use need: your Google account basics, the Google data you choose to connect, what you type into keyword research, and routine technical data.

Account information from Google sign-in

Google is the only way to sign in. When you do, Google shares your name, email address, profile picture and Google account ID with us (the openid, email and profile scopes). For each session we also record when it started and expires, and the IP address and browser user agent it came from.

Google Search Console data

When you press "Connect Google" you can grant GravitySEO read-only access to Search Console (the https://www.googleapis.com/auth/webmasters.readonly scope). With it we read:

• the list of properties (sites) you can access and your permission level on each;
• the sitemaps submitted for a property;
• search performance for a property: the search queries and pages, with clicks, impressions, click-through rate and average position, by date range.

Reports are read live from Google each time you open them. We do not keep copies of your Search Console reports. What we store is the OAuth refresh token Google issues and the list of scopes you granted, so the app can keep reading on your behalf without asking you to connect every hour. Keyword research results (below) keep, for each topic, the page of yours that ranks best for it, with that page's clicks, impressions and position. GravitySEO cannot change anything in Search Console.

Google Ads data (Keyword Planner)

Keyword research uses Google Ads Keyword Planner, through the Google Ads API, for keyword ideas, average monthly searches and advertiser competition. There are two ways this runs:

• Under the GravitySEO Google Ads account. By default, the keywords, competitor domains, language and location you enter are sent to Keyword Planner under our own Google Ads account. No Google Ads account of yours is involved and we receive no data about you from Google Ads.
• Under your own Google Ads account. If you choose to connect Google Ads, you grant GravitySEO the https://www.googleapis.com/auth/adwords scope. We use it only to list the Google Ads accounts you can access (their customer IDs and names) so you can pick one, and to request Keyword Planner ideas and historical search metrics under the account you pick. We store the refresh token, the scopes you granted and the customer ID you chose.

Google requires the full adwords scope even for planning. We never use it to create, edit, pause or remove campaigns, ad groups, ads, keywords, budgets, bids, conversion settings, billing or users, and we never spend money in your account. We do not read your campaign performance, billing or payment information.

What you enter about your product and in keyword research

For each Search Console property, we store the product description, seed keywords, competitor domains and market you enter, the product brief you write (features, pricing, how it differs from competitors, voice, claims to avoid and a call-to-action link), and the last research run's results (topics, keywords, search volumes, scores and coverage). If you use "Fill from URL", we fetch the public web page at the URL you give us to draft those fields. The page itself is not stored; only the fields you then save are.

Public pages on your site

To check which topics your site already covers, a research run reads the sitemaps submitted for the property (or /sitemap.xml) and the title and main heading of up to 120 of its pages. Only URLs on the property itself are fetched.

Technical data

Our hosting provider records standard request logs (IP address, browser user agent, the URL requested, time and errors) to run and secure the service. We do not use analytics, advertising or tracking tools.

We use your information only to provide the features you ask for, keep the service secure and talk to you about your account. In particular, we use it to:

• sign you in and keep you signed in;
• show your Search Console rankings, reports and content opportunities;
• run keyword research: generate keyword ideas, look up search volumes and competition, group keywords into topics and compare them with your existing pages;
• diagnose errors, prevent abuse and protect the service;
• answer your messages and tell you about important changes.

We do not sell your information, use it for advertising, build profiles of you for anyone else, or use it to train AI models.

GravitySEO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This covers everything we receive through Google sign-in, the Search Console API and the Google Ads API. Specifically:

• We use Google user data only to provide and improve the user-facing features described in this policy: rank reports, content opportunities and keyword research.
• We transfer Google user data to others only as necessary to provide or improve those features (to the service providers listed below), to comply with applicable law, or as part of a merger, acquisition or sale of assets after notifying you.
• We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
• We do not sell Google user data.
• We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine learning models, and we do not allow our providers to.
• No person at GravitySEO reads your Google user data unless you ask us to for a specific purpose (for example, to help with a support request), it is needed for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised for internal operations.

Data from the Google Ads API is also handled in line with the Google Ads API Terms and Conditions.

Keyword research uses OpenAI's API to brainstorm keywords, group them into topics, rate how well each fits your product and match topics to your pages. Only the data each step needs is sent:

• your product description, seed keywords, competitor domains and market;
• keyword ideas and their search volumes, from Google Autocomplete and Keyword Planner;
• the paths, titles and main headings of your site's public pages;
• for "Fill from URL", the text of the page you point it at.

We do not send OpenAI your Search Console performance data (your queries, clicks, impressions or positions), your name or email address, or any access token. Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models; OpenAI may keep it for a limited period to monitor for abuse. AI output can be wrong, so treat it as a starting point.

We share information only with the service providers that run GravitySEO for us, each limited to what its job needs:

• Neon (database and sign-in): stores your account, sessions, Google connection tokens, products and keyword research.
• Vercel (hosting): runs the app and keeps request logs.
• OpenAI (AI processing): receives the keyword research data listed above.
• Google: receives the requests that read your Search Console data and run Keyword Planner, and the seed keywords we send to Google Autocomplete for suggestions.

We may also disclose information if the law requires it, to protect the rights, property or safety of GravitySEO, our users or others, or to a buyer if GravitySEO is sold or merged, in which case we will tell you first and this policy, including the Limited Use commitments, will continue to apply to your data.

GravitySEO uses only the cookies it needs to work. There are no analytics, advertising or third-party tracking cookies, so there is no cookie banner.

• a session cookie that keeps you signed in;
• a short-lived cookie that protects the Google connection flow (state and PKCE verifier), removed when the flow finishes;
• a cookie remembering whether the dashboard sidebar is open;
• your light or dark theme choice, saved in your browser's local storage.

We keep your information for as long as you have an account, and delete it when you delete your account.

• Account and sessions: until you delete your account.
• Google connection tokens: until you delete your account, or until Google stops accepting them (for example after you revoke access in your Google account), at which point we delete them.
• Search Console reports: not stored.
• Products and keyword research: the product, its brief and the latest run for each property, until you change them, run the research again (which replaces the results) or delete your account.
• Request logs: kept by our hosting provider for a limited period set by its plan, then deleted automatically.

Deleted data can remain in our database provider's backups until they expire, for at most 30 days.

You can delete your account and all of its data yourself at any time, in Settings under "Delete account".

Deleting your account immediately and permanently removes your account, sessions, Google connection tokens, products and keyword research, and revokes GravitySEO's access at Google, so the app also disappears from your Google account. You can also revoke access at any time from your Google account's third-party connections; GravitySEO will then stop reading your Google data and ask you to connect again. If you cannot sign in, email maxwinterleinweber@gmail.com and we will delete your data for you.

We protect your data with encryption in transit and at rest and by keeping Google tokens on the server.

• All traffic to GravitySEO and between it and its providers uses HTTPS.
• Data is stored in a managed Postgres database that is encrypted at rest, and access to it is limited to the app and its operator.
• Google refresh tokens never leave the server and are never sent to your browser. The Google connection uses OAuth with PKCE and state checks.
• We ask Google only for the access each feature needs, read-only where Google offers it.

No system is perfectly secure. If we learn of a breach that affects your data, we will tell you and the relevant authorities as the law requires.

You can ask us to access, correct, export or delete your personal data, or to restrict or stop processing it, by emailing maxwinterleinweber@gmail.com. We answer within 30 days.

Depending on where you live (for example, under the EU and UK GDPR or California's CCPA), these are legal rights, and you can also complain to your local data protection authority. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using your rights.

Where the GDPR applies, we process your data to provide the service you signed up for (contract), with your consent for each Google connection (which you can withdraw by revoking it), for our legitimate interest in keeping the service secure and working (logs and abuse prevention), and to meet legal obligations.

Our providers may process your data in the United States and other countries outside your own. Where the law requires it, these transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses in our providers' data processing terms.

GravitySEO is not meant for children. You must be at least 16 to use it, and we do not knowingly collect data from anyone younger. If you think a child has given us their data, email maxwinterleinweber@gmail.com and we will delete it.

When this policy changes, we update the date at the top. If a change materially affects how we use your data, including any new use of Google user data, we will tell you by email or in the app before it takes effect and, where needed, ask for your consent again.

Questions, requests or complaints about privacy go to maxwinterleinweber@gmail.com. See also our Terms of service.