Privacy Policy

Account information — when you create an account or sign in, we collect your email address and display name and associate you with a workspace/organization. Authentication is handled by our provider, Supabase.

Authentication tokens — after you sign in, the extension receives a revocable device token stored locally in your browser; it is sent to our servers only to verify or revoke access.

Audit data you request — when you run an audit, the Service processes the content of the page you choose to analyze: its HTML, metadata, headings, links, images, structured data, and performance/accessibility metrics. In the extension, this is read in your browser and the results are stored locally on your device; they are not uploaded to us unless you use a web-app feature that saves a report to your account.

URLs and browsing context — the Service processes the URL of the page you audit and, for the extension's link-preview feature, the URL of a link you hover. This is used to perform the audit and is not compiled into a browsing-history profile.

Google Search Console data (optional) — if you connect Google Search Console, we access read-only performance and URL-inspection data for the properties you select. See “Google user data” below.

Diagnostic telemetry (extension) — to improve our structured-data validator, the extension may send us the names of schema.org types/properties it did not recognize, together with the page's hostname — never the page's content or your personal data. It is limited, infrequent, and tied to your account.

We do NOT collect precise location, financial or payment-card data (payments are handled by Stripe), health data, or keystrokes.

The extension requests broad host access (“read and change all your data on all websites”) so its side-panel tools can audit and capture the page you are viewing without a prompt on every use. In practice it only reads a page when you run a tool on it, plus a narrow content script on Google Search results and a lightweight hovered-link preview.

To make an audit reflect what you actually see, the extension fetches the page's raw HTML using your browser's cookies (content you can already access, including logged-in pages). This HTML is used only to compute audit results and remains on your device.

The extension stores its data — your session, audit history, and any connected-account tokens — in your browser's local storage (chrome.storage.local), not in Chrome Sync. You can clear it by signing out or removing the extension.

The extension contains no remotely-hosted or third-party executable code. The accessibility (axe-core) and performance (web-vitals) libraries are packaged inside the extension and run as our own code.

When you connect Google Search Console, you grant the read-only scope https://www.googleapis.com/auth/webmasters.readonly, plus openid and email which we use only to label the connected Google account.

SiteSonar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Search Console data solely to display your search performance and index status inside the Service. We do not transfer it to others, use it for advertising, or allow humans to read it, except as necessary for security or to comply with law, or with your explicit consent.

OAuth tokens are stored locally in your browser. You can disconnect a Google account at any time from the extension, which revokes the tokens.

• Provide, operate, and maintain the Service (run audits, show results, generate PDF/CSV exports).
• Authenticate you and enforce plan limits and organization access.
• Improve and debug the Service (for example, the limited validator telemetry described above).
• Communicate with you about your account and important service notices.

We do not sell your personal data, and we do not use it for advertising.

Service providers who process data on our behalf: Supabase (authentication and database), Vercel (hosting), Stripe (payments), and our email-delivery provider. They may process data only as needed to provide their service to us.

Google: only the read-only Search Console access you explicitly authorize.

Legal: we may disclose information where required by law or to protect the Service and its users.

Account data is retained while your account is active. Extension audit history is stored on your device and controlled by you. Connected-account tokens are retained until you disconnect. You may request deletion of your account and associated data (see “Your choices”).

We use industry-standard measures such as encryption in transit and access controls. Extension credentials are stored locally and are revocable. No method of transmission or storage is completely secure.

• Access, correct, or delete your account data by contacting us or using in-app settings.
• Revoke the extension's access at any time — sign out, remove the extension, or revoke from your account settings.
• Disconnect Google Search Console to revoke Google tokens.
• Depending on your location (e.g. EEA/UK, California), you may have additional rights such as access, portability, erasure, and objection. Contact us to exercise them.

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal data.

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice.

Questions or requests about this policy or your data: privacy@sitesonar.co.