Privacy and security

For the legal detail, read our privacy policy.

What we store

• Your account: your name, email address and password. The password is stored hashed, never in plain text.
• Google: the name, email address and picture of each Google account you connect, the permissions you granted, and the tokens that let us read Search Console. The tokens are encrypted.
• Search Console data: daily clicks, impressions, CTR and position for each site, page and query, plus device and country splits.
• Your work: Action plan items and their reviews, experiments, annotations, URL groups, brand terms and anything else you add.
• Crawl imports: the URLs and technical details from crawl files you upload, and the files themselves.

Who can see it

Everyone in a team sees that team's sites and data. Teams are kept apart: members of one team cannot see another team's data.

An AI assistant you connect acts as you, so it can see every team you are in. See Connect an AI assistant.

What we can do in Google

We ask Google for read-only access to Search Console. We cannot change your Search Console settings or anything else in your Google account. See Connect Search Console.

Remove data

Remove a site. On Sites, remove the site. It disappears from the app straight away, and we delete everything we hold for it:

• its Search Console data, including device and country splits and daily totals
• Action plan items and their reviews
• experiments, URL groups and the site's annotations
• topics and topic groups
• crawl imports, with the files you uploaded
• URL inspection results
• report results, alerts and daily digests

A big site can take a few minutes to clear. What stays:

• team-wide annotations, which belong to no one site
• weekly reports, which cover all your sites together: the emails already sent, and the copy we keep of each, can still mention the site
• our log of anything our support team did for you, which can name the site

Disconnect Google. In Settings, under Connected Google accounts. Remove the sites that use the account first. Disconnecting deletes the tokens we hold for it. To remove our access on Google's side too, remove Copilot SEO from your Google account's third-party connections.

Older history. Each night we delete page and query data older than your plan keeps. See How long your data is kept.

AI assistant access. On Connect AI assistant, revoke a token or disconnect an app. It stops working straight away.

Your account or a team. There is no button to delete your account or a team yet.

Keeping your account safe

• Before you create a personal access token or approve an AI app, we ask for your password again (at most once every three hours).
• A personal access token is shown once, when you create it. Copy it then.
• Resetting your password disconnects every AI app and revokes every personal token.
• A token for release markers can only add and update annotations on one site. Rotate it when someone who had it leaves. See Annotations.