Security

Last updated 11 September 2026

Plain statements about how your data is handled. If any of them stop being true, this page changes first.

Where things live

• The application and its database run on Railway (US West region). Data is stored in a managed Postgres database; backups are Railway's.
• Connections are HTTPS only. The sign-in cookie is HttpOnly, SameSite and Secure.
• Passwords are never stored — only a salted scrypt hash. We cannot read your password and never email it.

What we hold about you

• Your email, your name if you gave one, and your plan.
• The businesses you track: name, website, the reading of the site, the questions, and every AI answer collected for them.
• Sessions: a random token in your browser, matched to a row we can revoke.

We do not store payment card details. When billing opens it will be handled by Razorpay; card numbers never touch our servers.

Who else sees your data

• Questions are sent to AI systems through DataForSEO as anonymous queries with no account history and nothing that identifies you.
• Your website's public text and page list are sent to Anthropic's Claude to read what you sell and write questions. This is public content only.
• Emails are sent through Resend. Nothing else leaves the system. There are no advertising pixels and no analytics vendors on the dashboard.

Deleting

"Remove this business" on the setup page deletes the business and every answer, question and reading about it, immediately and without a copy kept. To delete your whole account, email [email protected] from the account's address; it is done within two working days.

Reporting a problem

If you find something that looks like a security flaw, email [email protected] with "Security" in the subject. You will get a reply from a person within two working days. Please do not test against other customers' accounts.