Privacy Policy

Information you provide

When you sign in with Google we receive your name, email address, and profile picture to create your account. New plan purchases are processed by Creem. Dodo Payments remains available for historical receipts. We receive your email address and the product purchased, never your card details.

Google user data we access

With your consent, CrawlRaven accesses the following Google data, read-only, on your behalf:

• Google Search Console (scope: webmasters.readonly): your property list and search analytics (queries, pages, clicks, impressions, positions, countries, devices) for the properties your Google account can access.
• Google Analytics 4 (scope: analytics.readonly): during restricted operator testing, the Google Analytics accounts and GA4 properties your Google account can access, and live aggregate reports for the property you select. These reports include active users, sessions, key events, event counts, daily totals, landing pages, source/medium, countries, and device categories. The customer-facing GA4 feature is currently Coming Soon.

We use Search Console data solely to provide dashboards, trends, keyword tracking, and SEO opportunity detection computed from your own data. During restricted GA4 testing, we use GA4 data only to let an authorized operator select a property and view its reporting dashboard. We never modify anything in your Google account, and we never access Google data of anyone who has not connected their own account.

Limited Use disclosure

CrawlRaven’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not allow humans to read it except with your explicit permission for support, for security purposes, or to comply with law. We do not use Google user data to train machine learning or artificial intelligence models.

How we store and protect data

Search Console reports are requested from Google when needed and may be temporarily cached on Cloudflare to load reports faster and avoid repeated requests to Google. We store compact website performance totals and product data such as targets, annotations, opportunities, and your actions in our PostgreSQL database, hosted on Hetzner and reached through Cloudflare Hyperdrive. Current reporting does not use a permanently stored query-by-page performance history. GA4 reports are requested directly from Google when the restricted dashboard is viewed, and GA4 report rows are not permanently stored. For a GA4 connection, we retain the selected property ID and name, the authorized Google account email, granted scopes, and an encrypted OAuth refresh token. Google OAuth refresh tokens are encrypted at rest with AES-256-GCM; access tokens are short-lived and never stored. All traffic is encrypted in transit with TLS. Access to production systems is restricted to the operators of CrawlRaven.

Sharing

We share data only with the infrastructure providers needed to run the service (Cloudflare and Hetzner for hosting, Creem for new payments, Dodo Payments for historical billing records, and DataFast for revenue attribution), each acting under their own security commitments. We do not sell personal data or Google user data to anyone, and we do not share it with advertisers or data brokers. DataFast receives signed-out marketing attribution events and payment metadata; it does not receive authenticated product activity or the Google user data connected to your account.

Retention and deletion

Temporarily cached Search Console reports expire automatically. We retain compact website performance totals and saved product data, including targets, annotations, opportunities, and your actions, while your CrawlRaven account remains active. We retain GA4 connection information while your account remains active or until the connection is deleted or replaced. You can disconnect Google access at any time from your Google Account permissions, which immediately prevents further data access. To delete your account and its associated data, email us and we will complete the deletion within 30 days, except where retention is required by law.

Cookies

We use session cookies required to keep you signed in. On signed-out pages, DataFast uses a first-party visitor cookie to connect a marketing source with a later checkout and payment. We do not use DataFast to track authenticated product activity, use advertising cookies, or sell this information.

Changes and contact

If this policy changes materially we will note it here with a new date. Questions or deletion requests: hello@crawlraven.com.