Privacy Policy

What we collect

• Account info: your email address and password. Password authentication is handled by our provider, Supabase, and we never see or store your raw password.
• Website data you connect: if you link your Google Search Console and Google Analytics accounts, we read (never modify) your search performance and traffic data, such as clicks, impressions, page views, and similar metrics, for the specific properties you authorize.
• Content data: post titles, URLs, and categories from your WordPress site, which you provide directly when setting up a site in the app.
• Billing info: handled entirely by Stripe. We store only your Stripe customer/subscription IDs and plan status. We never see or store your card details.
• Usage data: which features you use and how often, so we can enforce fair usage limits on metered features (like keyword lookups) and keep the product running reliably.

Google user data specifically

If you connect Google Search Console or Google Analytics, we request read-only access to that data. We use it solely to power the dashboards and recommendations inside this app. We do not sell it, share it with third parties, use it for advertising, use it to determine creditworthiness or lending eligibility, or use it to train any generalized AI/ML models. You can revoke access at any time from your Google Account permissions page, which immediately stops all access. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI and your data

Your content and your Search Console and Analytics data are never used to train AI models, ours or anyone else's.

Site Direction uses AI in two places. The optional help chat: when you ask it a question, we send your question and a short summary of your site (its name, niche, post and category counts, and whether Google is connected) to Anthropic's Claude so it can answer. And idea suggestions: when you click Find new ideas, we send the searches we found and your post titles to Claude so it can tell which ones your posts already cover. Neither includes your traffic numbers, and Anthropic doesn't use this to train its models.

If you choose to connect your own AI assistant (such as Claude) to Site Direction through our MCP connector, it reads your data on your behalf, under your account with that service. It's off unless you set it up.

How we protect your data

• Encrypted in transit: the entire app, and every connection to it, runs over HTTPS/TLS. Data is never sent unencrypted.
• Encrypted at rest: our database provider, Supabase, encrypts all stored data, including your connected Google Search Console and Analytics data, using AES-256 encryption, automatically and at all times.
• Access control: database-level security policies restrict data access to the account and workspace that owns it. Your data is never visible to another customer's account.
• Google tokens: your Google OAuth access is stored server-side only. It's never exposed to the browser or any client-side code, and you can revoke it at any time from your Google Account permissions page, which takes effect immediately.

Who else sees your data

We use the following services to run the app. Each processes data on our behalf:

• Supabase: database and authentication
• Vercel: hosting
• Stripe: billing and payment processing
• Google: Search Console and Analytics data, if you connect them
• DataForSEO: keyword search-volume and related-keyword lookups, for the terms you explicitly search
• Resend: transactional email (invitations, daily digest)
• Anthropic: answers questions you ask the in-app help chat (see "AI and your data" above)
• Sentry: error monitoring, so we can find and fix bugs

We do not sell your data, and we do not share it with anyone for advertising purposes.

Cookies & local storage

We use cookies and browser local storage to keep you signed in and to cache your data so pages load instantly on return visits. We don't use tracking or advertising cookies.

Data retention & deletion

We keep your data for as long as your subscription is active. If your subscription ends, we keep your websites and their data for 60 days so you can come back, and we email you reminders before then. After 60 days, that website data is permanently deleted. Your login (your email and account) is kept so you can subscribe again later without registering again. You can also remove a website and all of its data yourself at any time from the Billing page. If you'd like your account and associated data deleted entirely, contact us at the address below and we'll process the request.

Your rights

You can access, correct, or delete your data at any time by contacting us, and you can disconnect any Google account connection yourself at any time from within the app or from your Google Account settings.

Changes to this policy

If this policy changes materially, we'll update the date at the top of this page.

Contact

Questions about this policy? Contact matthew@dragonwebsiteservices.com.