Privacy Policy

We collect information you provide directly and information generated by your use of the service:

• Account data — name, email address, and profile picture obtained via Google OAuth sign-in.
• Project data — website domains, URLs, sitemap files, and crawl results you add or generate.
• Google integrations — OAuth tokens for Google Search Console (encrypted at rest using AES-256-GCM) and optional service account keys for the Indexing API.
• Usage data — pages visited, features used, actions taken, quota consumption, and submission history.
• Technical data — IP address, browser type, device type, and error logs collected automatically.

We use collected information to:

• Provide, operate, and improve the IndexPilot service.
• Authenticate your identity and maintain secure sessions.
• Connect to Google APIs on your behalf to crawl, inspect, and submit URLs.
• Send transactional emails (billing receipts, security alerts) — no marketing without consent.
• Monitor for abuse, enforce quotas, and detect errors via Sentry error tracking.
• Comply with legal obligations.

We do not sell your personal information to third parties.

Your data is stored in Google Firebase Firestore hosted in the United States. We apply these security measures:

• All Google OAuth tokens and service account keys are encrypted at rest using AES-256-GCM before storage.
• All data is transmitted over HTTPS/TLS.
• Firebase Security Rules restrict Firestore access to authenticated owners only.
• Access to production infrastructure is limited to authorised personnel.

No security measure is perfect. If you discover a vulnerability, please contact us immediately at security@indexpilot.com.

IndexPilot relies on these third-party providers, each with their own privacy practices:

• Google Firebase — authentication, database, and hosting infrastructure.
• Google APIs — Search Console and Indexing API, accessed only with your explicit permission.
• Vercel — application hosting and serverless functions.
• Sentry — error tracking and performance monitoring. Error payloads may include anonymised request context.
• Stripe — payment processing. We never store full card numbers.

We use cookies for authentication (session cookies) and optional analytics. You can manage cookie preferences via our cookie banner or your browser settings. See our Cookie Policy for full details.

Depending on your location, you may have rights to:

• Access — request a copy of the data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request deletion of your account and associated data.
• Portability — receive your project data in a machine-readable format (CSV/JSON export is available in-app).
• Objection — object to certain processing activities.

To exercise any right, email privacy@indexpilot.com.

We retain your account data for as long as your account is active. Project data, URLs, submission logs, and audit trails are retained for 12 months from the last activity date, then purged automatically. You can delete your account and all associated data at any time from the account settings page.

IndexPilot is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or in-app notification. Continued use of IndexPilot after changes take effect constitutes acceptance of the revised policy.