Privacy Policy

1. Who we are

IndexCyborg (“we”, “us”) runs the website at indexcyborg.com, the IndexCyborg dashboard, the REST API, the MCP server and the IndexCyborg Chrome extension (together, the “Service”). We are the controller of the personal data described here. Contact us at hi@indexcyborg.com for anything in this policy.

2. What we collect

Account data

Your email address and password when you sign up. Passwords are handled by our authentication provider and stored only as a hash. If you sign in with Google, we receive your name, email address and profile picture from Google.

Website data

The domains you add and their verification tokens; the sitemaps and URLs we discover; the results of fetching your public pages (HTTP status, redirects, robots directives, canonical, title, meta description and a hash of the content); IndexNow submissions and the responses we receive; issues, coverage snapshots and the activity log. This is mostly data about public web pages, but it is linked to your account.

Google Search Console data

If you connect Google, we store OAuth access and refresh tokens, the email address of the Google account, the Search Console property you link to each website and the URL Inspection results for URLs on the sites you add. See section 3.

API keys

A hash of each key (never the key itself), its prefix, name, scopes, website restrictions and when it was last used.

Chrome extension

The extension stores your API key, server address and settings in your browser's extension storage, plus a local log of its requests so it can respect the daily cap. Its script runs only on search.google.com. It sends us the URL it handled, the outcome and Search Console's message. Chrome describes its tabs permission as reading your browsing history; the extension uses it only to open, drive and close its own background Search Console tab, and does not collect your browsing history or read other sites. If you point it at a server other than the default, Chrome asks you to allow access to that one address.

Usage and technical data

IP addresses, browser type and request metadata that our hosting provider processes to deliver and protect the Service, and aggregated visit statistics from Google Analytics (see section 10).

3. Google user data

When you connect Google, IndexCyborg asks for Google's Search Console scope (webmasters), which allows viewing and managing Search Console data for your properties, plus your Google account email. We use it only to provide features you can see: listing your properties so you can link one, inspecting your URLs with the URL Inspection API, submitting your sitemaps to your property, and identifying which Google account is connected. We don't change anything else in your Search Console account.

IndexCyborg's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, use it for advertising, or use it to train AI models. People at IndexCyborg don't read it unless you ask us to (for support), it is needed for security, or the law requires it.

OAuth tokens are encrypted at rest with AES-256-GCM. You can revoke access at any time in your Google Account permissions, or ask us to delete the connection.

4. How we use it, and on what basis

• To provide the Service you signed up for: discovery, notifications, inspections, requests, checks, reports, the API and the extension. Basis: performance of our contract with you.
• To keep it secure and working: preventing abuse, enforcing rate limits and quotas, fixing problems. Basis: our legitimate interest in running a safe service.
• To understand how the website is used, in aggregate. Basis: our legitimate interest in improving the website.
• To contact you about your account, changes to the Service or this policy. Basis: contract and legitimate interest. We don't send marketing email without your consent.
• To meet legal obligations, such as tax records once billing exists. Basis: legal obligation.

5. Who processes it

We don't sell personal data. We share it only with providers that run parts of the Service for us:

• Supabase: database and authentication, hosted in the European Union (Ireland).
• Cloudflare: hosting, content delivery and network security.
• Google: Google Analytics for website statistics, and the Search Console APIs you connect.

At your direction, we also send the URLs of your verified sites to search engines through IndexNow. Those URLs are public web addresses, not personal data about you. We may disclose data if the law requires it, or to a successor if IndexCyborg is sold or merged, in which case this policy continues to apply.

6. International transfers

Cloudflare and Google may process data outside the European Economic Area. Where they do, transfers rely on the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

7. How long we keep it

• Account and website data: for as long as your account exists.
• Deleting a website deletes its sitemaps, URLs, inspections, checks, submissions, issues and activity right away.
• If you ask us to delete your account, we delete its data within 30 days. Backups held by our database provider expire on their own schedule.
• Hosting logs: kept by Cloudflare for a limited period, for security and troubleshooting.

8. Security

Traffic is encrypted with TLS. Dashboard requests reach the database with your own session, and row-level security limits them to your data. The API, the MCP server and background jobs use a service connection and check that every website they touch belongs to the key or account making the request. API keys are stored hashed, OAuth tokens are encrypted, and outbound page fetches are restricted to the public internet. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authority as the law requires.

9. Your rights

Depending on where you live, including under the GDPR, you can ask to access, correct, export or delete your personal data, to restrict or object to how we process it, and to withdraw consent at any time. Write to hi@indexcyborg.com and we will answer within one month. You can also complain to your local data protection authority.

10. Cookies and analytics

• Sign-in cookies keep you logged in. They are necessary for the Service and are not used for tracking.
• Google Analytics sets cookies (such as _ga) to count visits and see which pages are used. We use it for aggregate statistics only.
• Your theme choice (light or dark) is stored in your browser's local storage.

You can block or delete cookies in your browser settings. Blocking sign-in cookies means you can't stay logged in.

11. Children

The Service is for businesses and professionals and isn't directed at anyone under 16.

12. Changes

If we change this policy, we update the date at the top. For material changes we will also tell you by email or in the dashboard before they take effect. See also our Terms of Service.