What I keep about you

The waiting list

When you join, I keep your email address, the language of the page and the time you joined. Nothing else.

I use it for one thing: to tell you the day improvd opens. Until then you hear nothing from me.

I do not sell it, rent it, or share it with anyone.

To be taken off, write to me and it is deleted within a few days. Joining twice keeps one entry.

Cookies

improvd sets only the cookies it needs to work: one for your session, one that protects the forms, one that keeps you signed in until you sign out (for up to 400 days), and three that remember your language, light or dark, and whether your screen is a phone’s, each for a year. In the app, one more remembers whether the side menu is open. All of them stay on this site.

The first time you open this site, a small box asks if I may use cookies to count your visit with Google Analytics. Nothing from Google loads until you press Accept all, or turn it on under Choose cookies. If you press Necessary only, or choose nothing, it never loads.

If you say yes, Google Analytics sets its own cookies (the names start with _ga) and counts which pages you open and where you came from. There is no advertising and nothing that follows you across other sites.

Your choice is kept in a cookie: for a year if you say yes, for six months if you say no. You can change it at any time under Cookie settings at the bottom of every page.

Server logs and sessions

Like every website, the server that runs improvd keeps a log of the addresses that asked for pages, to keep it safe and working. Logs are kept for a short time and then deleted.

While you are signed in, your session keeps the network address your browser uses and the name of your browser. It is deleted soon after the session ends.

So that nobody can send a form thousands of times, improvd counts the tries from each network address for a few minutes, then forgets them.

Your account

An account keeps your name, your email address, the language you chose and the passkeys you added. That is who you are.

It also keeps the sites you added, the numbers Google has about them, what improvd read on them and what it wrote for you. That is the tool doing its work.

If you sign in with Google, improvd receives your name, your email address and the ID of your Google account. It keeps the ID, so the same Google account signs you in next time.

If you ask for a sign-in link and never press it, no account is made, and your email address is deleted within two days.

If you make a token for the API or for your coding agent, improvd keeps only a scrambled copy of it and the time it was last used.

To run improvd, I can see your email address, your plan, the addresses of your sites and whether their reads work. I do not look at your numbers unless you ask me for help.

You can delete your account under Settings. Your name, your email address, your sites and everything read for them go with it. improvd keeps one line that says an account was there, with no name and no email: when it was made and deleted, and the plan it had. Removing one site takes that site and its history and leaves the rest.

Your numbers from Google

When you connect Google Search Console, improvd reads the numbers Google keeps about your site: clicks, impressions, CTR, position, the queries people typed and the pages they landed on. It reads as you, through the permission you gave, and only for the sites you picked.

If you add improvd’s own email address as a user of your site in Search Console instead, improvd reads the same numbers through that address, and only for that site.

It reads 16 months back, which is as far as Google keeps them, and a little every day after that, so your history is not lost when Google drops it.

These stay while the site is in improvd. Remove the site and they go with it, with the links the web has to it. What Google shows for a search, and how often it is searched, are kept for 12 months without your site’s name, because any site can ask about the same search.

What improvd reads on your site

improvd fetches your pages the way a search engine does: the title, the description, the headings, the links and up to 20,000 characters of the text. It reads only the sites you added, and it obeys your robots file.

It keeps every reading of a page from the last 12 months, so it can tell you what changed and whether a change worked. Of older readings it keeps the newest 10 of each page and the first of every three months, so it knows how old a page is. All of them go when the site is removed.

Google user data

improvd’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

In plain words: what Google tells improvd about your site is used only to give you the things you see in improvd. It is never sold. It is never used for advertising. It is never used to train an AI model. Nobody reads it but you, and me only if you ask me for help with a problem.

You can take the permission away whenever you like, under Settings here or in your Google account.

The emails improvd sends

A sign-in link, each time you ask for one.

One email when the first read of a site is done.

An email when a change you made has worked, and a short email on Thursdays about what happened on your sites. You can stop both with the link at the bottom of each one, or under Settings.

Emails about your plan: when it starts, when a payment does not go through, when it is cancelled and when it ends. These come while you have a plan.

No newsletters and no offers. Emails are sent through Resend, which receives your email address and the email itself.

Payments

A paid plan is sold through Lemon Squeezy, which takes the payment for improvd. You type your card and your billing address on its page, never on improvd, and improvd never sees your card number.

improvd keeps what it needs to give you your plan: which plan, monthly or yearly, until when it is paid, whether the last payment went through, the kind of card and its last four digits, and the numbers Lemon Squeezy gives the order and the subscription.

It also keeps the messages Lemon Squeezy sends about your payments, as the record of what was paid. When you delete your account, your name and your email address are taken out of them.

Deleting your account cancels your subscription at Lemon Squeezy first. Lemon Squeezy sends your receipts and invoices, and its own privacy policy says what it keeps.

Who else sees any of it

Every visit passes through Cloudflare, which protects improvd from attacks. It sees your network address and the pages you ask for.

improvd runs on Laravel Cloud, on Amazon’s machines in the United States. That is where everything above is kept.

When something breaks or is slow, Laravel Nightwatch is told what happened: which page, the error and how long it took. It is given a random code that stands for your account, never your name or your email address.

Emails are sent through Resend.

Payments go through Lemon Squeezy. When you open its checkout, it is given your name and your email address, so the receipt reaches you.

To write a fix, a page, or a check of a keyword, OpenAI is sent your site’s address, the page’s address, title, description and first heading, its numbers and its searches, the names and addresses of some of your other pages, and what Google shows for the search. The whole text of a page is not sent. OpenAI is asked to keep none of it, and none of it is used to train a model.

To find out what Google shows for a search, and how many people search it, the search itself is sent to DataForSEO. Neither your site’s address nor your email address is sent.

To show what the rest of the web says about your site, your site’s address is sent to Ahrefs, Moz and Open PageRank.

If you allow it, Google Analytics receives your visit to this site: the page, the page you came from, your browser and device, and roughly where you are. Google keeps it for up to 14 months.

Apart from Resend, which needs your email address to send you an email, and Lemon Squeezy when you pay, none of them is given your name or your email address.

Outside the European Union

Most of these companies keep data in the United States. Where your data leaves the European Union, it goes under the protections the law asks for, such as the European Commission’s standard contractual clauses.

Why the law allows it

Your account, your sites, your numbers and your payments: to give you what you signed up for. That is our contract.

Server logs, sessions and the count of tries on a form: to keep improvd safe and working. The law calls this a legitimate interest.

Google Analytics, and the waiting list: only because you said yes. You can take it back at any time.

Payment records: because accounting law asks me to keep them.

How long it is kept

Your account, and each of its sites: until you delete them.

The readings of a page: up to 10, and none older than 12 months.

A sign-in link nobody pressed: two days.

A session: until soon after you sign out or stop using improvd.

Payment records: as long as accounting law asks, without your name and your email address once your account is deleted.

How it is kept safe

There is no password to steal: you sign in with a link sent to your email, a passkey, or Google.

The permission to read your Search Console is kept encrypted, and a token is kept only as a scrambled copy.

Every page and every answer travels over an encrypted connection.

If you find a weakness, please write to me.

Children

improvd is for people aged 16 and over. If a child under 16 has given me their data, write to me and I delete it.

Your rights

You can ask what I hold about you and get a copy of it, ask for it to be corrected or deleted, ask me to stop using it or to use it less, and take back a yes you gave.

Write to me for any of it. You get an answer from a person, not a form, within one month.

You can also complain to the data protection authority where you live. In Romania, where improvd is run, that is ANSPDCP, at dataprotection.ro.

When this page changes

The date at the top says when it last changed. If a change matters for you, I send an email to everyone with an account before it applies.