Privacy policy

When you create an account: your email address and a password hash, both handled by Supabase Auth (we never see your plain password). When you connect a repository: its name, the production URL you provide, and the audits, issues and pull-request metadata RankForge generates for it.

When you turn on monitoring: the alert email address and webhook URL you enter, and a record of each check: the score, what changed, and a snapshot of the public pages it read (status codes, titles, canonicals, the issues found). History is kept for 3 months on Free, 12 on Pro and 24 on Studio; older checks are deleted automatically. Removing a site deletes its monitor and every check.

When you subscribe to a paid plan: your Stripe customer id, the subscription's status, renewal and cancellation dates. Invoices are kept by Stripe, as accounting law requires.

No advertising trackers, no analytics resale, no selling of your data. It goes only to the services listed below, and only for what they do to run RankForge. RankForge reads your site's rendered HTML and your repository structure; it never reads your environment secrets.

The open-source CLI and the editor agent (MCP) run on your machine. They send nothing to RankForge.

• Supabase stores the data in a PostgreSQL project with row-level security, so each account can only ever read its own rows. It also handles sign-in.
• Vercel hosts the app and keeps the request logs any web host keeps.
• Resend delivers the monitoring emails: the alert address, the site name and what changed.
• Stripeprocesses payments for Pro and Studio. It holds your card and billing details; RankForge only keeps your Stripe customer id, the subscription's status and its renewal date, and never sees your card.
• Anthropic: audit runs may call its API to analyze crawled pages. Only the crawled page content and detected issues are sent, never your credentials.
• Google: when Core Web Vitals are turned on, the monitored site's URL is sent to the Chrome UX Report API to read its public field data. Nothing else is sent.

Alerts you route to Slack, Discord or your own webhook are delivered to the URL you entered, and that service's own policy applies to them.

Email hugopoene74@gmail.com from your account address and your account and all associated data will be deleted. GDPR requests (access, rectification, erasure) go to the same address.