Privacy Policy

2.1 Account Information

When you create an account with Greadme, we collect:

• Email address: Used to identify your account and to contact you
• Username: Your display name within the platform
• Sign-in: You sign in with your email address and a password, or with Google, GitHub or X. Sign-in is handled by Clerk, our authentication provider, which keeps any password in hashed form; Greadme never receives or stores a password. If you sign in with Google, GitHub or X, that provider shares your name and email address with us
• Account creation date: Timestamp of when your account was created

2.2 Website Data

To provide our audit and analysis services, we collect:

• Website URLs: The domains and pages you submit for analysis
• Crawl data: Technical information about your website's structure, performance, and SEO elements
• Audit results: Generated reports, recommendations, and analysis data
• Domain visibility preferences: Your settings for public/private sharing of progress pages
• Scheduled Audits: For each schedule, the audit, the page, the days, the time, your time zone and how the report is delivered (email or push notification), and a record of each run, kept for 90 days
• Page Audits without an account: Anyone can run a Page Audit without signing in. The report's link opens it for 14 days. After that the report no longer opens for anyone, but we keep its results (the page address, the device it was tested on, the scores, the issues found and their details, the performance measurements and the AI summary), linked to no account or person and with no set deletion date, for analysis, research and articles about how websites perform, and to improve Greadme. The page screenshots in the report are deleted within a day after its link expires. We also keep a short record of each attempt (the page address, when it ran and how it ended, the type of device you used — phone, tablet or computer — and the result of the Google reCAPTCHA check: the score it gave the request, or the code Google gave for refusing it; but no IP address and not your browser's user agent) for 14 days, to find and fix problems. To have a report's results deleted, email us its link at support@greadme.com. To stop automated abuse, the request is checked by Google reCAPTCHA, and our hosting provider counts requests per IP address to limit how many audits one address can run in a short time
• Content Audits without an account: Anyone can run a Content Audit without signing in. The report's link opens it for 14 days. After that the report no longer opens for anyone, but we keep its results (the page address, the scores, the notes and the word count), linked to no account or person and with no set deletion date, for analysis, research and articles about how websites perform, and to improve Greadme. To have a report's results deleted, email us its link at support@greadme.com. To stop automated abuse, the request is checked by Google reCAPTCHA, and our hosting provider counts requests per IP address to limit how many audits one address can run in a short time
• Page Audit counts by campaign: Each time a Page Audit is requested, whether you are signed in or not, we add one to a daily total for the campaign link of the page you ran it from (the utm_source, utm_medium, utm_campaign and utm_term tags in its address, such as the ones on our ads), your country (which our hosting provider works out from your IP address; we do not store the address), whether you were signed in and the type of device you used (phone, tablet or computer, worked out from what your browser sends; we do not store its user agent), and to how the request ended: the audit succeeded, failed or was cancelled, or the request was refused before the audit started, and why. We keep only these daily totals, for 400 days, with no IP address, account, page address, report or other identifier. Nothing is stored on your device for this, so it does not depend on your cookie choice

2.3 Google Search Console Integration

If you choose to connect your Google Search Console account, we collect:

• OAuth authorization tokens: Access and refresh tokens to retrieve your Search Console data
• Property information: List of websites you own in Google Search Console
• Performance data: Search queries, impressions, clicks, and rankings (read-only access)
• Selected property: The specific website you choose to analyze

Important: Greadme only requests read-only access to your Google Search Console data. We cannot modify, delete, or alter any of your Search Console information. We use this data solely to provide insights and analytics within our platform.

2.4 monday.com Integration

If you choose to connect your monday.com account, we store:

• OAuth authorization token: The access token monday.com issues when you approve the connection, encrypted at rest
• Your monday.com user name and id: To show which account is connected
• Your last destination: The board, group, status column and assignee you last sent tasks to
• A log of what was sent: Which audit issue became which monday.com item, so the same task is never created twice

Important: Greadme reads your list of boards (with their workspace names) and the names of the people in your monday.com account only to let you pick a destination and an assignee. Neither list is stored: both are read from monday.com each time you open the dialog. We write to monday.com only when you press Send: the issues you selected are created as items, with their details, on the board you chose, assigned to the person you picked. We never read the items, updates or files on your boards.

You can disconnect at any time from Settings, which deletes the stored token. To also end Greadme's access on monday.com's side, uninstall the Greadme app from your monday.com account.

2.5 Subscription and Payment Information

• Subscription details: Your plan type, status, renewal dates, and payment history
• Payment information: Processed securely through LemonSqueezy (we do not store credit card details)
• Customer ID: Reference number for your subscription account

2.6 Usage and Analytics Data

• Log data: IP address, browser type, operating system, and device information
• Usage patterns: Pages visited, features used, and time spent on the platform
• Cookies: Small data files stored on your device (see Section 9 for details)
• How you found Greadme: Only if you allow Analytics (Section 9): the page you first landed on, the referring site, and any campaign tags (utm_*) of your first visit, kept in your browser for up to 90 days and stored with your account when you sign up, so we can tell which of our marketing brings people to Greadme. With them we store when you allowed Analytics and which version of our cookie choices you agreed to, as the record of that consent. If you later turn Analytics off while signed in, these details are deleted from your account. If you create your account by connecting an AI assistant to Greadme (our MCP server), we store instead only that your account came through that connection, and when; no cookie, browser storage or tracking identifier is involved, so this is recorded whatever your cookie choice, and it is deleted in the same way if you turn Analytics off while signed in
• Push notifications: If you turn on push notifications on a device, the push subscription your browser gives us for that device; it is deleted when you turn push off on that device or delete your account
• Emails we send you: Which of our account emails we sent you and when, so none is sent twice and an unsubscribe is respected, kept for 400 days

2.7 AI Assistant Connections (MCP)

If you connect Greadme to an AI assistant (such as Claude or ChatGPT) through our MCP server, the assistant signs in with your Greadme account, and you approve the connection on a Greadme consent screen. The assistant receives access to your basic profile and email address only, which is how we know which Greadme account a request belongs to. If you do not have a Greadme account yet, one is created for you on your first request, as if you had signed up on our website.

When the assistant uses a Greadme tool, we process and store:

• Free checks (AI access and structured data): An AI access check, and structured-data markup the assistant sends, are used only to run that check and are not stored. A structured-data check of a web address is saved to your Greadme dashboard, with that address, exactly like the same check run on our website while signed in
• Audits (the Page Audit, the Site Audit, the Content Audit, the Product Audit and the AI Visibility Checker): An audit runs in the background and uses your plan's allowance, as on our website. While it runs, a temporary job record holds the web address to audit (and, for a Page Audit, whether to test it as a phone or a computer; for a Site Audit, how many pages to crawl; for a Product Audit, what kind of product the page sells, if you chose one; for an AI Visibility check, the questions to ask and their language); the address and the questions are removed from the record as soon as the audit finishes or fails, and the record itself (which account it belongs to, its status and a link to the report) is deleted after 7 days. The finished report is saved to your Greadme dashboard exactly like an audit you run on our website, and is kept and deleted the same way
• Scheduled Audits: A schedule the assistant creates or changes is stored exactly like one made on our Scheduled Audits page (Section 2.2), and runs, saves its reports and is deleted the same way
• Usage counts: For each day and each tool, how many requests your account made and how many failed. The addresses you checked are never recorded. These counts are kept for about 400 days
• Rate-limit counters: Short-lived counters that stop any account or website from receiving too many requests. A counter for a website names that website and is deleted about two minutes later
• Operational logs: For each request, which tool ran, whether it succeeded, how long it took and which AI assistant sent it, and for an audit its job number and outcome, without the address checked

Important: The results are sent back to the AI assistant you connected, which handles them under its provider's own privacy policy. For an audit this includes a link to the saved report; like any report link on Greadme, anyone who has the link can open the report. Greadme does not receive your conversations with the assistant, only the tool requests it sends.

You can remove Greadme from your AI assistant's connector settings at any time. When you delete your Greadme account, your usage counts, rate-limit counters, audit job records and saved reports are deleted with it.

4.1 Authorization and Access

When you connect your Google Search Console account to Greadme, we use Google's OAuth 2.0 protocol to securely authorize access. This process:

• Redirects you to Google's authorization page (we never ask for your Google password)
• Requests read-only access to your Search Console data
• Provides us with temporary access and refresh tokens after you grant permission
• Allows you to revoke access at any time through your Google Account settings or Greadme's disconnect feature

4.2 Token Storage and Security

Your Google OAuth tokens are handled with the highest security standards:

• Encryption: All access and refresh tokens are encrypted using industry-standard encryption before being stored in our database
• Secure transmission: Tokens are transmitted only over HTTPS connections
• Limited access: Only authorized Greadme systems can decrypt and use these tokens
• Automatic refresh: Tokens are automatically refreshed as needed, with a 5-minute buffer for validity checks
• Token revocation: When you disconnect Google Search Console or delete your account, we immediately revoke the tokens at Google's API

4.3 Data Usage and Caching

To optimize performance and reduce unnecessary API calls to Google, we implement a caching system:

• Cached insights: The Search Console figures Greadme requests for your property — clicks, impressions, click-through rate and position by query, page, country, device, search appearance and date — including the same figures for the period before the one you view, which GSC Insights compares against
• Cache duration: Each cached answer is deleted automatically 8 hours after it was last fetched
• Timestamp tracking: Each cached item includes a "lastFetched" timestamp
• No data modification: We only read and display your Search Console data; we never modify or delete it

4.4 Disconnecting Google Search Console

You can disconnect your Google Search Console integration at any time. When you do:

• We immediately revoke the OAuth tokens at Google's API
• All encrypted tokens are deleted from our database
• Cached Search Console data is cleared from your account
• We can no longer access your Google Search Console information

5.1 Security Measures

We implement comprehensive security measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Encryption at rest: Sensitive data (including OAuth tokens) is encrypted in our database
• Authentication: We use Clerk, a secure authentication provider, to manage user accounts and sessions
• Password security: Passwords are hashed using industry-standard algorithms (never stored in plain text)
• Access controls: Strict internal access controls limit who can view or modify user data
• Regular security audits: We regularly review and update our security practices

5.2 Database Storage

Your data is stored in MongoDB, a secure and reliable database system. Our data model includes:

• User account information and preferences
• Encrypted Google OAuth tokens
• Audit results and crawl data
• Subscription and payment references (actual payment data is handled by LemonSqueezy)
• Cached Search Console insights for performance optimization

5.3 Third-Party Security

We rely on trusted third-party services for specific functions:

• Clerk: Authentication and user management (SOC 2 Type II certified)
• LemonSqueezy: Payment processing (PCI DSS compliant)
• Google Cloud: OAuth integration and Search Console API access
• monday.com: OAuth integration and item creation, only for accounts that connect it
• Google PageSpeed Insights: The Lighthouse analysis behind the Page Audit; it receives the address of the page being audited and loads that page
• Anthropic (Claude): Writes the Page Audit's AI summary, scores the Content Audit, answers the AI Visibility Checker's questions, and checks the text of a page's Movie, Course, FAQ or Q&A structured data during a Page Audit or Content Audit for content that Google's structured-data rules do not allow; it receives the audit data, the page content being analyzed, or the questions
• OpenAI (GPT): Answers the AI Visibility Checker's questions and suggests questions from a page's content; it receives the questions, or the page content
• Google (Gemini): Answers the AI Visibility Checker's questions; it receives the questions
• Resend: Delivers our emails; it receives your email address and the email's content
• Upstash (QStash): Runs Scheduled Audits and AI-assistant audits in the background; it receives only an internal job number
• Your browser's push service: Delivers push notifications to a device where you turned them on; the notification is encrypted, so the push service cannot read it

6.1 Active Account Data

• Account information: Retained for the duration of your active account
• Audit results: Kept while your account exists, until you delete them. On the Free plan, your dashboard and progress pages show your 10 most recent audits; older ones are kept and appear again if you upgrade
• Page Audit screenshots: On the Free plan, deleted 60 days after the audit; the report itself remains available. Paid plans keep them
• Page Audits run without an account: The report opens through its link for 14 days after the audit. After that it no longer opens and its screenshots are deleted within a day; its results are kept, linked to no account or person, with no set deletion date (Section 2.2). The record of each attempt is kept 14 days
• Content Audits run without an account: The report opens through its link for 14 days after the audit. After that it no longer opens; its results are kept, linked to no account or person, with no set deletion date (Section 2.2)
• Server logs: Request logs (IP address, browser and request details) are kept by our hosting provider for a short period, currently about one day, for security and troubleshooting
• Records kept for a fixed time: Scheduled Audit run history, 90 days; the record of emails we sent you, 400 days; AI assistant usage counts, about 400 days (Section 2.7); daily Page Audit counts by campaign and country, 400 days (Section 2.2); temporary crawl progress, 1 hour
• Cached data: Search Console data is deleted automatically 8 hours after it was last fetched (Section 4.3)

6.2 Account Deletion

When you delete your Greadme account, we execute a comprehensive cleanup process to ensure your data is permanently removed:

Immediate Actions:

• Subscription cancellation: Active subscriptions are immediately cancelled with LemonSqueezy
• Google OAuth revocation: All Google Search Console access tokens are revoked at Google's API
• Token deletion: Encrypted OAuth tokens are deleted from our database
• Scan data deletion: All your Page Audit, Site Audit, Content Audit, Product Audit, AI Visibility Checker and Schema Validator reports are permanently deleted
• Folder deletion: All user-created folders and organizational structures are removed
• Other records: Your Scheduled Audits and their run history, push notification subscriptions, the record of emails we sent you, cached Search Console data, and the log of tasks sent to monday.com are deleted
• AI assistant usage records: Your MCP usage counts and rate-limit counters are deleted
• Account record deletion: Your user account and all associated personal information are permanently deleted from our database

Complete Data Removal: Upon account deletion, ALL of your personal data, audit results, and associated information are permanently and irreversibly removed from our systems. We cannot recover this data after deletion.

6.3 Anonymized Data

We may retain anonymized, aggregated data that cannot be linked to you personally for analytical and service improvement purposes. This data includes:

• General usage statistics (e.g., "X users performed Y audits this month")
• Performance metrics to optimize our infrastructure
• Trend analysis to improve our features

This anonymized data does not contain any personally identifiable information.

7.1 Our Policy

We do not sell, rent, or trade your personal information to third parties.

We only share your information in the following limited circumstances:

7.2 Service Providers

We share data with trusted third-party service providers who assist in operating our platform:

• Clerk: Authentication and user account management
• LemonSqueezy: Subscription billing and payment processing
• Google Cloud Platform: OAuth services and Search Console API integration
• monday.com: Receives the audit issues you choose to send to your own boards
• Google PageSpeed Insights: Receives the address of each page you run a Page Audit on
• Anthropic: Receives the audit data and page content that the Page Audit's AI summary and the Content Audit analyze, the text of a page's Movie, Course, FAQ or Q&A structured data that a Page Audit or Content Audit checks, and the AI Visibility Checker's questions
• OpenAI: Receives the AI Visibility Checker's questions, and the page content it suggests questions from
• Google (Gemini): Receives the AI Visibility Checker's questions
• Resend: Email delivery; receives your email address and the content of the emails we send you
• Upstash (QStash): Background job queue for Scheduled Audits and AI-assistant audits; receives only an internal job number
• Browser push services: Deliver the push notifications you turn on, encrypted so that the service cannot read them
• MongoDB Atlas: Secure database hosting
• Vercel: Application hosting and deployment

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

7.3 Advertising

We do not use advertising or ad-measurement services, and we do not share your information with advertisers. We previously used Google Ads and measured which ad clicks led to sign-ups; that measurement ended in October 2026, and the advertising identifiers we had stored with accounts have been deleted.

7.4 Legal Requirements

We may disclose your information if required by law, such as:

• To comply with a subpoena, court order, or legal process
• To protect our rights, property, or safety, or that of our users or the public
• To investigate or prevent fraud, security issues, or illegal activity
• In connection with a merger, acquisition, or sale of company assets (with advance notice to affected users)

7.5 Public Sharing Features

How others can see your results:

• Saved reports: Every saved report has its own link, and anyone who has that link can open the report. Greadme does not publish these links or let search engines index the report pages, but a report link is an unlisted link, not a password: do not rely on it to keep a report private. A Page Audit or Content Audit run without an account has a link too, which opens the report for 14 days
• Progress pages: Private by default; only you can view a domain's progress over time
• Public progress sharing: You can choose to make a domain's progress page public, and change this at any time

When you share a report link or make a progress page public, anyone with the link can view it. Be mindful of what you choose to share.

8.1 Access and Portability

• View your data: Access all your account information and audit results through your Greadme dashboard
• Download reports: What you can download depends on your plan: Site Audit reports as Excel or CSV files on the Basic, Pro and Agency plans, Page Audit reports as Excel or CSV files on the Pro and Agency plans (and with invited Creator access), and AI Visibility Checker results as a JSON file on every plan. The Free plan includes no Excel or CSV downloads
• Request a copy: Whatever your plan, contact us to request a comprehensive copy of your personal data

8.2 Correction and Updates

• Update account info: Change your account details, such as your email address, from Manage account in the account menu
• Correct inaccuracies: Contact us to correct any inaccurate personal information

8.3 Deletion

• Delete your account: Permanently remove your account and all associated data from Manage account in the account menu, or by emailing us
• Delete specific data: Remove individual audit results or folders you no longer need
• Disconnect integrations: Disconnect Google Search Console or monday.com at any time

8.4 Communication Preferences

• Account emails: Our welcome, reminder, plan and usage emails each carry a one-click unsubscribe link that turns all of them off; there is no separate settings switch. Payment receipts from LemonSqueezy are not affected
• Scheduled Audit reports: You choose email or push notification for each schedule, and can pause or delete a schedule at any time; whether a device receives push notifications is set under Settings, Notifications
• Cookies: Change or withdraw your cookie choice at any time with "Cookie settings" at the bottom of every page (Section 9)

8.5 Exercising Your Rights

To exercise any of these rights, please contact us at support@greadme.com or use the settings within your Greadme account. We will respond to your request within 30 days.

9.1 Your Choice

When you first visit Greadme, a banner asks whether you allow analytics. Nothing optional is turned on until you choose "Accept all" or switch Analytics on under "Customise"; "Reject all" leaves it off, and Greadme works the same either way. We keep your choice for 6 months and then ask again, or sooner if this section changes. You can change or withdraw it at any time with "Cookie settings" at the bottom of every page. Withdrawing stops Google Analytics in that browser and deletes its cookies and the first-visit record kept in your browser; if you are signed in, it also deletes the first-visit details stored with your account (Section 2.6). It does not delete what Google Analytics collected before you withdrew: Google holds that data and keeps it for the period in Section 9.3.

9.2 Necessary (Always On)

• Sign-in: Clerk's session cookies keep you signed in and protect your account
• Security: Google reCAPTCHA checks requests to our free tools for automated abuse. Its script loads from Google, may set Google's own cookies, and sends Google information about your browser and the page; the Google Privacy Policy and Terms of Service apply
• Your cookie choice: A cookie (greadme_consent) that remembers what you chose, for 6 months. If you turn Analytics off while signed in, your browser's storage also notes that our server received it, so it is sent only once
• Invitation cookie: If you sign up through an invitation, a cookie holds the invite code for up to one hour while you create your account
• Accessibility toolbar: The UserWay widget lets anyone adjust contrast, text size and other display settings. It loads from UserWay's servers (cdn.userway.org) and keeps those settings in your browser's storage; UserWay may collect basic usage data to improve the toolbar
• Your preferences: In your browser's storage, not sent with every request the way a cookie is: which in-app notifications you have read or dismissed, and whether you have dismissed a hint or prompt (such as the install-app hint)

9.3 Analytics (Only If You Allow It)

• Google Analytics (measurement ID: G-TDMDEQR58L): which pages and tools are used, how people move between them and where they get stuck, so we can improve Greadme. It sets cookies (_ga and _ga_TDMDEQR58L) that recognise your browser with a random identifier. Google signals and ad personalisation are switched off. Google holds this data. Our Google Analytics property is set to keep the data linked to that identifier for 14 months, counted from your latest visit (the period starts again each time you come back), after which Google deletes it; Google's aggregated reports, which do not identify you, are not limited by that period. If you create an account while Analytics is on, our server also tells Google Analytics that a sign-up happened, with that identifier
• How you found Greadme: The page you first landed on, the referring site and any campaign tags (utm_*) of your first visit, kept in your browser for up to 90 days and stored with your account if you sign up, with when you allowed Analytics (Section 2.6)

9.4 Counts Without Cookies

Vercel, our hosting provider, counts page visits for us (Vercel Web Analytics): the pages viewed, the referring site, the country, and the type of device, browser and operating system. It stores nothing on your device. Vercel recognises a visit by a code computed from the request that changes every day, so visits cannot be linked across days or across websites. It runs for every visitor; see Vercel Web Analytics privacy. We also count Page Audits by campaign link, country and type of device as daily totals, for every visitor, with nothing stored on your device (Section 2.2).

9.5 Managing Cookies in Your Browser

You can also control cookies through your browser settings. Blocking the necessary ones may stop you signing in or using the free tools. Most browsers allow you to:

• View and delete cookies
• Block all cookies
• Block third-party cookies
• Receive notifications before cookies are set