Privacy Policy

When you use ansly, we may collect the following information:

• Account information (email address) when you sign up
• URLs and domains you submit for auditing
• Audit results and scores stored against your account
• Usage data such as pages visited and features used
• A browser cookie fingerprint for unauthenticated (guest) sessions
• Google Search Console and Google Analytics data, only if you choose to connect your Google account (see section 7)

We use the information we collect to:

• Provide and improve the audit service
• Store your audit history and enable score tracking
• Enforce fair-use limits (e.g., per-domain audit rate limits)
• Respond to support and feedback requests
• Send transactional emails related to your account (if applicable)

Audit data, account details, and feedback messages are stored using Supabase (PostgreSQL) hosted infrastructure. We do not sell your data to third parties. We apply the following safeguards to all data we hold, including sensitive data such as Google account data and third-party API credentials:

• Encryption in transit. All traffic between your browser, ansly and every upstream provider (Google, Ahrefs, Bing and our AI providers) is encrypted using HTTPS/TLS. We do not accept unencrypted connections.
• Encryption at rest. Our database is encrypted at rest by Supabase, so all stored data — including audit results and Search Console and Analytics metrics — is protected on disk.
• Additional encryption of credentials. Google OAuth tokens and any third-party API keys you provide are additionally encrypted by ansly before they are written to the database, using AES-256-GCM authenticated encryption. The encryption key is held in our application environment and is never stored in the database, so these credentials cannot be read from a database copy alone. Tampering with an encrypted credential causes decryption to fail rather than return a value.
• Access control and isolation. Data is scoped to the workspace that owns it and is visible only to you and the members you invite. Isolation is enforced both in our application and at the database level through PostgreSQL row-level security policies.
• Least privilege. We request read-only scopes from Google and never write to, modify or delete anything in your Search Console or Analytics account. We request only the scopes needed for the features described in section 7.
• Credential deletion. When you disconnect an integration we revoke the token with the provider and delete our stored credentials immediately, as described in section 7.
• Restricted human access. Access to production systems is limited to personnel who need it to operate the service. We do not allow humans to read your Google user data except in the narrow circumstances set out in section 8.
• Incident response. If we become aware of a breach affecting your personal data, we will notify affected users and any applicable regulator without undue delay.

We use a single session cookie (guest_fingerprint) for unauthenticated users to associate audit results with a browser session. Authenticated users are identified via a Supabase session cookie. Google Analytics is used to track website usage.

ansly sends queries to AI providers (OpenAI, Anthropic, Perplexity, Google) as part of the citation probing feature. URLs you audit may be submitted to these services. Please review their privacy policies before auditing sensitive URLs.

Audit results are retained for 1 year while your account is active. You may request deletion of your data by contacting us at the address below. Guest audit data is associated with a browser cookie and may be removed when the cookie expires (30 days). Authenticated user data is retained for as long as your account is active.

ansly offers optional integrations with Google Search Console and Google Analytics. These are off by default. If you choose to connect them, you authorise ansly through Google OAuth and you select which Search Console properties and Analytics properties we may read. You can disconnect at any time from your ansly settings, or revoke access directly at myaccount.google.com/permissions.

We request read-only scopes and use them as follows:

• webmasters.readonly — reads Search Console performance data (clicks, impressions, click-through rate and average position, broken down by date, search query and page) for the properties you select, so we can show you your organic search performance alongside your AI citation results.
• analytics.readonly — reads Google Analytics session and engagement metrics (broken down by date, page path, session source, channel group, city and country) plus your property's configured custom dimensions and key events, so we can attribute traffic that reaches your site from AI assistants and from organic search.

We never write to, modify or delete anything in your Search Console or Analytics account. The data we retrieve is stored against your ansly workspace and is visible only to you and the members of that workspace. When you disconnect an integration we revoke the access token with Google and delete our stored credentials immediately; the performance metrics already retrieved are kept as historical reporting data under the retention terms in section 6, and are deleted when you delete your account or on request via our Contact page.

Automated analysis. Our findings features analyse the Search Console and Analytics metrics we retrieve using deterministic rules that run on our own servers. The findings those rules produce — which can include search query text and page paths — are then sent to a large language model so that a numeric finding can be phrased as readable advice. This happens at the time you request a report, and the data is used only to generate that report for you. We do not use Google user data to develop, improve or train any artificial intelligence or machine learning model.

ansly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the features described in section 7.
• We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition.
• We do not use Google user data for advertising purposes.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
• We do not allow humans to read Google user data, unless we have your explicit consent, it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised.

The Ansly browser extension ("Ansly — Free AEO / GEO / SEO Checker") analyzes web pages locally in your browser. It does not collect, store, or transmit any personal data or browsing history to Ansly or any third party.

• All audit analysis runs entirely within the extension — no data is sent to Ansly servers
• The only network requests made are to the website you are auditing (to fetch its robots.txt, sitemap.xml, and llms.txt files)
• Audit results are cached locally in your browser's extension storage and are never sent externally
• No browsing history, cookies, passwords, or personal information is accessed or collected
• The extension does not track you across websites

For privacy-related questions, please visit our Contact page.