01
Free public website checks
When you submit a website, Your Rank retrieves its public homepage without account credentials and checks the delivered HTML. We remove submitted paths, query parameters and fragments before starting; public homepage redirects may be followed after destination checks. Results contain the checked URL, time, a small set of extracted public-page signals and server response measurements. Results may be cached in server memory for up to ten minutes and are kept in browser session storage, with a 24-hour display limit. Signup from the results can prefill the website address in setup. A short-lived hashed network identifier and counters limit abuse; raw IP addresses are not saved in those counters, which expire after twenty minutes and are cleaned up on subsequent requests. Normal infrastructure logs may separately contain request metadata under our security provisions. The free check does not connect accounts, publish changes or measure search rankings.
02
Customer workspace guide
The signed-in workspace guide uses your active website’s saved setup checklist, subscription feature access and execution mode to provide product instructions. Guide questions and answers are saved separately for your account and website so they can reopen after refresh. It does not receive connection credentials or perform website changes. You can choose to copy recent guidance into a support message, review it and send it to our team. Never include passwords, connection keys or payment-card details. These records follow our support-data retention and deletion provisions below.
03
Public Ranky chat and support requests
Ranky answers public product questions using Your Rank’s product knowledge and current plan catalogue. Public chat questions and answers are stored as a separate support conversation; authorised staff can review unanswered questions to improve published product guidance. A conversation token is kept in your browser’s local storage so you can reopen that chat. Choosing human support shares the conversation, your name, email and message with our team; callback requests also include the phone number and optional preferred time you supply. The request is saved in the admin support inbox and a notification with the conversation is emailed to contact@yourrank.co. We use a short-lived hashed network identifier for abuse limits, without saving the raw IP address in those limits. Do not provide passwords, private keys or payment-card details in chat. Public Ranky does not access connected customer accounts or change their settings. Support records follow the retention and deletion provisions below.
04
Visitor performance measurements
When a workspace owner enables Your Rank visitor performance and the visitor gives analytics consent, the public-page tag sends loading, visual-stability and interaction-responsiveness values, a random metric identifier for that page lifecycle, a coarse viewport device group and a diagnostic-test flag. It sends no full URL, query, IP address, cookie value, interaction target or persistent visitor identifier. The tag creates no cookie. Our server transiently receives normal connection metadata needed to answer the request, but does not store that metadata in performance samples. Samples are retained for the latest 28 days and purged on collection or scheduled maintenance. Reports distinguish diagnostic browser checks from consented field samples; browser submissions are not independently verified human identities. Owners can disable collection or replace their installation key. On the Your Rank public website this uses the existing analytics consent choice.
05
Server crawl evidence
Authorised owners can import a single-site access-log export. Supported sensitive fields are removed in the browser before upload; saved reports contain public page paths, response-group counts, declared crawler categories and available aggregate server durations, not raw IP addresses, cookies, request bodies, referrers or user-agent strings. Where Your Rank has configured server access, a scheduled worker produces a bounded recent-window report. Your Rank's public website access log excludes account and API requests, deletes request and response headers and IP fields at logging, and records public paths without queries. Its sanitised source log is size-rotated with two retained rotated files; its active file may remain until the next rotation. Only the latest aggregate crawl report is retained per workspace. Prior Google authorization disclosures were updated October 16, 2026; those service-specific restrictions remain unchanged.
06
Optional browser monitoring
With your explicit authorization, the Your Rank browser extension opens configured searches, Maps views and AI prompts while your browser is running. Automatic monitoring uploads result titles, links, answer text, source addresses, timestamps and map viewport centers to the paired workspace; it does not upload screenshots, passwords, browsing history or existing AI conversations. AI prompts use your signed-in source account and may consume its allowance. Manual captures can include the screenshot you choose to submit. The extension stores its private pairing key locally; Your Rank stores a hash of that key and encrypts saved observation content. Pairing expires after 30 days. You can pause monitoring or revoke browser access from Your Rank. Up to 50 automatic checks are retained per workspace, subject to our account retention and deletion policy.
07
Billing information
Paddle processes payments as merchant of record. Your Rank stores subscription identifiers, plan and payment status, billing dates and transaction details needed for your account. Your Rank does not collect or store your full payment-card number or card security code.
08
Information collected
Account identity, business profile information, connected website data, authorized connected-source data, platform activity and support requests.
09
How information is used
To provide audits, recommendations, approved execution, verification, reporting, security, support and product improvement. Google user data is used only as described in the Google-specific sections of this policy.
10
Authorization data
Your Rank does not request customer passwords for third-party platforms. OAuth tokens and connector credentials are encrypted and scoped.
11
Google account data and permissions
Connecting Google services is optional. You choose the Google account, services and website workspace to connect. Your Rank requests openid and email to identify the authorized account, together with the permissions for the services you select. We access the authorized email address, granted permission scopes, connection time and OAuth tokens. Access tokens are used to call the authorized APIs; refresh tokens are stored encrypted so connected features can continue without repeated sign-in. We do not request your Google password. These connections do not request Gmail messages, Google Drive files or Google Contacts.
12
Search Console: data accessed and why
With the webmasters.readonly permission, Your Rank reads the website property URLs and permission levels available to the connected account so you can select an eligible property. For your selected website, we access search query text, clicks, impressions, click-through rate, average position and reporting date ranges. We compare reporting periods to show search performance, keyword opportunities and changes, inform growth-plan recommendations and baselines, and produce the reports you request. This permission is read-only; it does not authorize changes to your Search Console properties.
13
Analytics: data accessed and why
With the analytics.readonly permission, Your Rank reads available Analytics account names, property names and property identifiers so you can select a property. For the selected property, we request aggregate active-user, session and page-view totals for the reporting period. When you refresh business results or a strategy review collects them, we also read configured key-event names and aggregate counts, the property identifier and reporting dates. These may represent enquiries, bookings or purchases according to the events you configure. We use these totals to display website activity and performance reporting, save dated business-result snapshots and compare suitable reporting windows alongside verified website work. These comparisons do not establish that a website change caused a business result. This integration does not request individual visitor profiles. Analytics access is read-only: Your Rank does not create, change or delete Analytics properties, settings or reports.
14
Business Profile: data accessed and why
When you separately choose to connect Business Profile, Your Rank requests the business.manage permission. Google describes this as management access. The current connector uses it to read accessible business account identifiers, names and types, and business location identifiers, titles, website addresses, storefront addresses, phone numbers, categories and location metadata, including Maps links where available. This information lets you identify and connect the correct business location to your website workspace and view its details. For the selected location, we also read customer review identifiers, reviewer display names, ratings, review text, dates and existing business responses, together with business post text, dates, publication status and links. We use this information to display current reviews and posts in your workspace. When you explicitly approve a public review response, we send that response to the selected business location. Approved campaigns may publish their text and supplied image to that location through your authorized publishing settings and schedule. We store campaign drafts, approved publishing snapshots and provider receipts to track delivery and avoid duplicate submissions. Connecting an account alone does not publish content. Your Rank does not edit or delete the Business Profile itself. Availability also depends on Google's approval of access and your account permissions.
15
Storage of Google data
Your Rank stores the connected account's email address, granted permissions, connection time and encrypted refresh token, together with the account, property or location identifiers and workspace selections needed for your connections. When you use reporting and growth-plan features, we also retain saved performance reports, baselines and recommendations derived from authorized data. Data remains associated with the authorized customer account and workspace. Disconnecting and deletion are explained below.
16
Google Ads: separate optional connection
Ad Protection uses a separate Google Ads authorization with the adwords permission. With that authorization, Your Rank accesses the advertising customer and optional manager identifiers, selected campaign identifiers, names and advertising channel types, and campaign IP-exclusion information needed to apply, verify and remove exclusions under your Ad Protection settings. We store the encrypted refresh token, connection and campaign settings, and enforcement records for your workspace. Search Console, Analytics and Business Profile data is not transferred into advertising campaigns. Google Ads authorization is separate from connecting those reporting services.
17
Protection of sensitive data
Your Rank protects sensitive data, including Google authorization data, with the following mechanisms: HTTPS encrypts data in transit between your browser and Your Rank and between Your Rank and Google; stored OAuth refresh tokens and connector credentials are encrypted at rest using AES-256-GCM; encryption keys are held in protected server configuration and are not returned to the browser. Server-side authentication and account/workspace authorization restrict access to connected data. Administrative access is controlled by assigned roles. Application data is kept in a private server directory with restricted operating-system access, and off-server database backups are encrypted and access-restricted. Report data is available only within the authorized account and workspace. These safeguards reduce risk but do not guarantee absolute security.
18
Use and sharing of Google user data
Google user data is used to provide the connected reporting, website-performance analysis and growth-plan features you request. Your Rank does not sell Google user data, use it for advertising or transfer it to advertising platforms, data brokers or credit-scoring services. Google user data is not used to train generalized artificial-intelligence or machine-learning models. Hosting and security providers may process only the data needed to operate these features. Human access is limited to your explicit consent for support, necessary security or abuse investigations, legal obligations, or internal operations involving aggregated and anonymized data. Your Rank's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy).
19
Data sharing
Information is not sold. Service providers may process only the information required to host, secure or deliver the platform.
20
Pricing and checkout
Public prices may be displayed as estimates converted from USD using exchange rates. To suggest a currency, your browser may request an approximate country from a location service, which receives your IP address. Your browser's regional settings provide a fallback, and your chosen currency may be saved on your device. The secure checkout shows the billing currency, applicable taxes and final amount before you confirm payment.
21
Retention and deletion
Records are retained while required for the service, security and legal obligations. Disconnecting a Google service stops its synchronization for the selected workspace and clears that service's property selection; previously saved reports are not automatically deleted by disconnecting. An account authorization may remain available to another connected workspace or service. You may also revoke Your Rank's access in your Google Account's third-party connections settings. Contact contact@yourrank.co to request deletion of stored Google authorization data, saved reports, a workspace or your account. We verify ownership and remove data no longer required for the service, subject to legal and security retention obligations. Deleted data may remain in access-restricted backups until those backups expire under the backup retention schedule.
22
Your choices
Customers can revoke integrations, pause automation, export available records and request correction or deletion.
Contact contact@yourrank.co for privacy questions, access, correction, deletion or available data exports. We may verify account ownership before acting on a request. Applicable privacy rights are not limited by this policy.