Privacy policy

Rankwell (“we”) operates rankwell.cc and is the data controller for the information described here. Write to [email protected] about anything on this page.

• ·Your account. Email address, an optional name, and when the address was confirmed. If you set a password we store only a scrypt hash of it, never the password. If you sign in with Google we store the account identifier Google gives us, not your Google password.
• ·Your sessions. A random token is set as a cookie; the database holds only its SHA-256, so a copy of our database does not hand anyone a working session.
• ·What you looked up. Each audit, keyword search and domain lookup is recorded with the domain or phrase and the time, because plan limits are counted from it.
• ·Audit results. The pages we crawled for you, their status codes, titles and the problems we found.
• ·Billing. If you subscribe, Stripe holds your card details and we never see them. We store the Stripe customer and subscription identifiers, your plan, and when the period ends.
• ·Failed sign-ins. Your email address and IP address are recorded briefly when a sign-in fails or an email is sent, so passwords cannot be guessed and inboxes cannot be flooded.

We do not use advertising trackers, we do not run analytics scripts that follow you across other websites, and we do not sell anything about you to anyone.

Your account, audits and billing records are processed to provide the service you asked for (performance of a contract). Failed sign-ins and rate-limit records are kept because we have a legitimate interest in stopping people breaking into accounts. Where we rely on consent, such as connecting another service to your account, you can withdraw it at any time by disconnecting it.

Running Rankwell means asking other services questions. These are the ones that can see anything about you:

• ·Hetzner hosts the servers, in Germany.
• ·Stripe handles payments and holds the card details we never receive.
• ·Our email provider delivers confirmation and password-reset emails, so it sees your address.
• ·Google receives the address of a site when we ask PageSpeed Insights or the Chrome UX Report about it, and receives your email address if you choose to sign in with Google.

The other sources we use — Cloudflare Radar, Tranco, Wikipedia, the Internet Archive, certificate logs and the rest, all listed on Where our data comes from — are asked about websites, never about you.

When you audit a site we fetch its pages the way a search engine does, identifying ourselves as RankwellBot and obeying robots.txt. We only read what the site publishes to anyone. Analysing a website tells us nothing about its visitors, and we have no way to see who visits any site.

• ·Your account and its audits stay until you delete the account.
• ·Sessions expire after 30 days; sign-in links after 24 hours and reset links after 30 minutes.
• ·Failed sign-in and rate-limit records are only counted within a rolling window and are not used afterwards.
• ·Billing records are kept as long as tax law requires, which is usually several years.

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to [email protected] and we will answer within 30 days. If you are in the EU or UK and are unhappy with our answer, you can complain to your national data protection authority.

Rankwell sets one cookie when you sign in, and a short-lived one during sign-in to keep that exchange safe. Both are strictly necessary for the site to work, so no consent banner is required, and neither is used to profile you or follow you anywhere else.

If this policy changes in a way that affects you, we will say so on this page and update the date above before the change takes effect.