Privacy Policy

Your account. When you sign up we store your name, email address and password (kept only as a secure hash, never in readable form). If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.

Sign-in sessions. While you are signed in we keep a session record with the IP address and browser type it came from, so we can keep you signed in and spot misuse.

Your business profile. Answers you give during onboarding, such as what kind of business you run, your main website and your goals, and how you arrange your dashboard.

What you check with the tool. The websites and pages you analyse, the searches we find for them, the Google results and AI Overviews we read for those searches, and the reports built from them: content gaps, site audits, product reports, backlink prospect lists, Launch Kits, and SERPY AI settings, digests and drafts.

Public contact details of other websites. When you ask the tool to find contacts, it reads public pages of the websites involved and saves the email addresses, phone or WhatsApp numbers, social profiles and contact pages those websites publish. We only collect what the website itself makes public.

How the site is used. If you accept analytics cookies, Google Analytics records pages visited, approximate location, device and browser details. See our Cookie Policy.

StealMySERP needs its Chrome extension to check Google. When you run a check, the extension opens Google searches in your own browser (in a hidden page by default, or in a tab if you choose that or Google asks you to verify), reads the results page (rankings, "People also ask", AI Overviews, Shopping results and related searches) and sends those results to StealMySERP.

• It only acts when the StealMySERP website asks it to run a search.
• It only reads google.com search pages it opened itself. It does not read your other tabs, browsing history, passwords or form data.
• Because the searches run in your browser, Google sees them as coming from you, as with any search you type yourself.

You can connect Google Search Console to see your real Google rankings. This is optional, and you can use StealMySERP without it. When you connect, Google asks you to give StealMySERP read-only access to your Search Console data (the webmasters.readonly permission).

What we access. The list of sites your Google account has in Search Console, and their search performance: the searches your site appeared for, the pages that appeared, clicks, impressions, click-through rate and average position, for the country you choose (or all countries).

How we use it. Only to show you your own search performance: your rankings, how your clicks and impressions change over time, and which searches are close to page one. We do not show it to anyone else, sell it, use it for advertising, or use it to train AI models. We cannot change anything in your Search Console: no settings, users, sitemaps or verification.

What we store. When you link a website to a Search Console property in Settings, we copy its daily search performance into our database once a day, so the dashboard can show trends. We keep it for up to 16 months, the same as Search Console itself. Quick checks in the free tools are read from Google each time and not stored. We also store the access and refresh tokens Google gives us, so you don't have to reconnect every hour. They are encrypted in our database and tied to your account.

Disconnecting. Removing a website under Settings → Google Search Console deletes the search data we stored for it straight away. You can also remove StealMySERP's access at any time from your Google Account permissions. Once removed, our stored tokens stop working and syncing stops. Tokens and stored search data are deleted when you close your account, or sooner if you email [email protected].

StealMySERP's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To run the checks you ask for and show, save and export your results.
• To keep your account secure and keep you signed in.
• To build automatic features you switch on, such as the daily SERPY AI digest.
• To understand how the site is used and improve it (only with your consent for analytics).
• To reply when you contact us and to send important notices about the service.

We do not sell your personal information, and we do not use it for advertising.

We use a small number of service providers to run StealMySERP. They only process data to provide their service to us:

• Vercel: hosts the website and runs our servers.
• Neon: hosts our database, where your account and saved results are stored.
• OpenRouter and the AI model providers it routes to: receive the page text, search results and instructions needed to write your analysis. They do not receive your name or email address.
• Google: provides Google sign-in (if you use it), Search Console data (if you connect it), Google Analytics (if you accept it), and website icons. To show a site's icon, its domain name is sent to Google's icon service.
• Public data sources: when checking a domain we look it up in public registration records (RDAP) and the Internet Archive, and SERPY AI reads Google News feeds. Only the domain or topic is sent.

AI answers are cached for up to 7 days by a fingerprint of the request, so an identical request (for example, re-checking the same public page) can reuse an earlier answer instead of calling the AI again.

We may also disclose information if the law requires it, or to protect our users or the service.

Our providers run servers outside Bangladesh, including in the United States and the European Union. By using StealMySERP you understand your information will be processed there.

• Account and profile details: while your account is open.
• Saved reports and results: until you delete them or close your account. You can delete saved pages from your dashboard at any time.
• Cached AI answers: up to 7 days.
• Search Console data: up to 16 months for websites you link in Settings, deleted when you remove the website. Quick checks in the free tools aren't stored. The Google tokens are kept until you close your account or ask us to delete them.
• Google Analytics data: kept by Google for the retention period set in our Analytics account (between 2 and 14 months).

When you close your account we delete your account and saved results within 30 days, except where the law requires us to keep something longer.

You can ask us to show you the information we hold about you, correct it, export it, or delete it, and you can object to how we use it. To close your account or make any of these requests, email [email protected] from the address on your account. We reply within 30 days.

If you are in the European Union or the United Kingdom, you also have the right to complain to your local data protection authority.

Connections to StealMySERP are encrypted, passwords are stored only as hashes, and every saved record is tied to the account that created it. No system is perfectly secure, so please use a strong, unique password.

StealMySERP is not meant for anyone under 16, and we do not knowingly collect information from children.

If we change this policy we will update the date at the top. If a change is significant, we will tell signed-in users in the dashboard or by email before it takes effect.