Privacy policy

• Your account: email address; if you sign in with Google, your name, email and profile picture from your Google account.
• Your sites: the address you add, what RankHabitBot reads from its public pages (see About RankHabitBot), and the profile you confirm.
• Your content: keywords, plans, articles, edits and images you create in RankHabit.
• Publishing connections: the details you enter to publish to WordPress, Framer, Lovable, Webflow (coming soon) or a webhook, stored encrypted.
• Billing: when paid plans are available, Stripe processes your payment. Card details go to Stripe and are never stored by us. We keep your plan, your Stripe customer id and your subscription status.
• Usage: what jobs ran and what they cost, so we can apply plan limits.
• The free AI visibility checker (no account): the site address and question you enter and the answers, kept for 24 hours so the same check isn't paid for twice. For its daily limit we keep a one-way scrambled stand-in for your IP address that changes every day, never the address itself, and delete it after 7 days.
• Visits to rankhabit.com: through DataFast, your IP address, browser and device information, the page that sent you, the pages you visit, and a few events: creating an account, approving your first plan, starting a checkout, connecting a site to publish to, sending a support message, and running a free AI visibility check (whether your site was named) and clicking its button to track it. These events carry no email address or content.
• Product use, through PostHog: the pages you visit and what you click, errors in the app, and these events: creating an account, adding a site, connecting a site to publish to, a plan being made and approved, an article being written and published, starting a checkout, and a subscription starting, ending or a payment failing (plan and amount). Once you log in they are tied to your account id and email. A free tool check (the AI crawler checker or the AI visibility checker) is counted anonymously, without the address or question you entered. We also record sessions to see where the app is hard to use: everything you type is masked, the text of your articles is masked, and the screens with passwords, keys, webhook secrets, billing setup and support screenshots are never recorded.

To run the service (read your site, research keywords, write and publish articles), to keep your account secure, to apply plan limits and billing, to answer support emails, to fix problems, and to measure how people find and use rankhabit.com and which visits lead to a purchase.

We email you about your account: a welcome, your first article, your plan for the next billing period, your first article going live, one note about the paid plans after your free article, and payment problems. A setup reminder, approval reminders, a weekly results email and a follow-up about the paid plans are optional: turn them off in Settings → Email or with the unsubscribe link in each one.

We don't sell your data and we don't use it for advertising.

Signing in with Google. If you sign in with Google, we receive your name, email address and profile picture from your Google account. We use them only to create your RankHabit account, sign you in and keep it secure.

Connecting Google Search Console. If you choose to connect Search Console, we ask for read-only access (https://www.googleapis.com/auth/webmasters.readonly), and only then. We read the list of Search Console properties you can access, and, for the property you pick, daily clicks, impressions, click-through rate and average position for each page. We use this data only to show you how your own site and articles perform inside RankHabit, and to help you plan your content. We never add or change anything in your Search Console.

We store this data in our database (Supabase). The access token Google gives us is encrypted. We don't sell Google user data, don't use it for advertising, and don't use it to train general AI models. People at RankHabit don't read it, except with your permission, for security, or when the law requires it. We don't share it with anyone except the processors that run RankHabit for us, or when the law requires it.

Once you've connected Search Console, you can disconnect it in RankHabit at any time, or remove RankHabit's access at https://myaccount.google.com/permissions. When you disconnect, or when your account is deleted, we delete the stored token and your Search Console data.

RankHabit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use these providers to run RankHabit. They process data for us under their own terms and security practices.

• Supabase: database, login and file storage. It holds your account, sites, content and connections.
• Vercel: hosting, and AI Gateway, which routes our AI calls. It handles every request to rankhabit.com.
• AI model providers through Vercel AI Gateway (today Anthropic's Claude models): write and check articles. They get your site profile, keywords and research material.
• Inngest: runs our background jobs. Job events carry ids, not your content.
• DataForSEO: keyword and Google search data, and ChatGPT's answers for AI visibility checks. It gets keywords, questions and your site's domain.
• Perplexity: Perplexity's answers for AI visibility checks. It gets the question being checked.
• Cloudflare Turnstile: checks that a person, not a bot, is using the free AI visibility checker. It runs in your browser on that page and processes your IP address and browser information.
• Resend: email delivery: login codes, and our emails about your account, plan, articles and billing. It gets your email address and the message.
• Stripe: payments, when paid plans are available. It gets your payment details; we never see your card.
• PostHog (US cloud): product analytics, error reports and session replays, in your browser and from our servers. It is reached through our own address (rankhabit.com/ingest), so it processes your IP address, browser and device information. It gets the pages you visit, clicks, the product events listed under “What we collect” tied to your account id and email once you log in, and recordings of how you use the app with every field you type in masked, your articles' text masked, and the screens with passwords, keys, secrets, billing setup and support screenshots left out entirely.
• DataFast (datafa.st): website and product analytics and revenue attribution on rankhabit.com. It sets two first-party cookies (datafast_visitor_id and datafast_session_id) and processes your IP address, browser and device information, the referring page, the pages you visit and the events listed under “What we collect”. When you start a checkout, we pass those two identifiers to Stripe with it, so a purchase can be credited to the visit that led to it.

Some of them process data in the United States and other countries.

We keep your data while your account is open. When your account is deleted, your workspace, sites, content, connections and Search Console data are deleted. Backups held by our providers are overwritten on their normal cycle. We keep billing records for as long as the law requires.

To delete your account and its data, email contact@rankhabit.com from the address you sign in with. We'll confirm and delete it within 30 days. Once you've connected Search Console, you can disconnect it in RankHabit at any time, and remove access from your Google account at https://myaccount.google.com/permissions.

You can also ask for a copy of your data, or for us to correct it, the same way.

We use cookies to run RankHabit: Supabase's login cookies, which keep you signed in, one cookie that remembers which of your sites you have open, and a short-lived one set right after you create an account, so the signup is counted once. On rankhabit.com, DataFast also sets two first-party analytics cookies, datafast_visitor_id and datafast_session_id, to recognise a returning visitor, group the pages of one visit, and credit a purchase to the visit that led to it. PostHog keeps one first-party cookie and the same in your browser's local storage (named ph_ followed by our project key) with a random visitor id and the current session, so a visit and a session replay hang together; logging out resets it. We don't use advertising cookies.

Data travels over HTTPS, and the passwords, keys and tokens you connect are encrypted before we store them. Access to the database is limited by row-level security, so each account can only reach its own data.

RankHabit is for businesses and isn't meant for anyone under 16.

If we change this policy, we'll update the date at the top. If a change matters, we'll tell you by email or in the app before it takes effect.

Questions or requests: contact@rankhabit.com.