Privacy Policy

Last updated: August 19, 2026

EchoRanked ("we", "us") measures how AI answer engines cite and rank your brand, and helps you improve that visibility. This policy explains what data we collect, why we collect it, who we share it with, and the choices you have. It applies to the EchoRanked website, application, and the analytics tracker our customers install on their own sites.

Information you provide

When you create an account we collect your email address and either a password or a social identity, depending on how you sign in. Your account also stores a timezone and your subscription tier.

Signing in with Google

If you choose "Continue with Google", we ask Google only for the basic sign-in scopes (your name, email address, profile picture, and whether Google has verified that address). We do not request access to your Gmail, Drive, Calendar, contacts, or any other Google service through sign-in. From the response we store your email address, name, profile picture URL, Google's stable account identifier, and the sign-in tokens Google issues — enough to recognise you the next time you sign in, and nothing more. We never receive or store your Google password.

If you already have an EchoRanked account with the same address, we link the two only when Google confirms the address is verified. The Google sign-in client is separate from the client used for the Search Console integration below, so signing in never grants us access to your Search Console data. You can disconnect EchoRanked at any time from your Google account permissions page; if you do, sign in with a password instead or contact us to delete the account. Microsoft sign-in works the same way with the equivalent Microsoft scopes.

To use the product you supply information about your brand: your website URL, brand name and aliases, a description of what you sell, buyer personas, competitor lists, the prompts you want tracked, and any documents or pages you add as knowledge sources. If you invite teammates, we store their email addresses and roles. If you join our waitlist, we store the email address and website you submit.

Information collected automatically

Our own website uses only functional cookies: a session cookie that keeps you signed in, and a short-lived cookie used to secure OAuth connections. We do not run advertising trackers or third-party analytics scripts on our site, and we do not use cookies to profile you.

Data we process on your behalf: the tracker

If you install the EchoRanked tracker on your website, we process data about your site's visitors on your behalf. The tracker is deliberately minimal:

• It is cookieless. It sets no cookies and no device identifiers; it keeps first-touch referrer information in the browser's session storage only.
• We do not store IP addresses and we do not store raw user-agent strings. The user agent is parsed into a device and browser category and then hashed.
• We record only visits referred by AI engines (and conversions you define); other traffic is discarded rather than stored.
• Location is limited to country level, derived from network edge headers. Region and city granularity is available only on the Business tier.
• For AI crawler logging, the crawler's IP address is checked against the operator's published ranges to verify authenticity, then discarded — only the bot name, verification result, page, and timestamp are kept.

You are responsible for making any disclosures to your own visitors that the law of your jurisdiction requires when you install the tracker on your site.

Data from AI engines and your website

To measure your visibility we query AI answer engines with the prompts you track and store the answers verbatim, including any citations, so every number in your dashboard has an auditable receipt. When our readiness checks visit your website, we store the pages they fetched and the evidence they extracted so you can see exactly what produced each verdict. We also crawl pages listed in your sitemap to score how readable they are for language models, and the Content Agent may store screenshots of reference pages it researched while drafting content for you.

Google Search Console

Connecting Google Search Console is optional — the product works without it. If you do connect it, we ask for a single read-only scope,webmasters.readonly. That scope lets us read the Search Console properties you have access to and their search performance data; it does not allow us to change your properties, submit or remove URLs, alter settings, or read anything outside Search Console.

We import and store, per property you connect:

• the list of verified site URLs on your Search Console account, so you can pick which property to connect;
• aggregated search performance rows — the search queries your site appears for, the pages that appear, and the clicks, impressions, click-through rate, and average position for each, broken down by date, country, and device.

Search Console returns this data already aggregated and anonymised by Google; we do not receive, and cannot derive, the identity of any individual searcher. We use it for one purpose: to show you how your existing search demand compares with your AI visibility, and to suggest prompts worth tracking based on queries you already rank for. Prompts suggested this way are labelled as coming from Search Console. We do not use your Search Console data to train machine-learning or generative-AI models, we do not combine it with other customers' data, we do not sell it, and we do not use it for advertising.

The OAuth refresh token is encrypted at rest with AES-256-GCM, held in a private storage bucket rather than our database, never logged, and used only to fetch the data described above. You can disconnect Search Console at any time from Project Settings → Search Console, which stops all further imports and discards the stored token; you can also revoke access from your Google account permissions page. Imported Search Console data is deleted with your project or account.

EchoRanked's use and transfer of information received from Google APIs — for both Google Sign-In and Search Console — adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service providers

We rely on third-party providers to run the service. Data is shared with them only as needed to provide the feature you are using:

• Amazon Web Services — hosting, database, and file storage.
• Cloudflare — DNS, CDN, and bot protection; provides the country-level geolocation used by the tracker.
• OpenAI, Anthropic, Google (Gemini), Perplexity — AI engines we query with your tracked prompts; Anthropic and Google models also power content generation, suggestions, and readiness analysis, which may include your brand information and site content.
• cloro.dev and SerpApi — capture of consumer-surface AI answers (what a real user sees in ChatGPT, Google AI Overviews, and similar products).
• DataForSEO — search volume and keyword difficulty for suggested prompts.
• Firecrawl and Exa — crawling and search used to analyze your site and research content.

How we use information

We use your data to provide and improve the service: running scans, computing your visibility metrics, generating recommendations and content, enforcing plan quotas, securing accounts, and responding to support requests. We do not sell personal data, and we do not use your site's visitor data for anything other than showing you your own analytics.

Security

OAuth tokens are encrypted at rest, tracker ingest keys are stored only as hashes, and answer receipts and agent screenshots live in private storage buckets scoped to your account. Access to production data is restricted, and API credentials are never exposed to the browser.

Retention and deletion

We keep your data while your account is active. When your account is deleted, your projects and everything attached to them — scan results, answer receipts, analytics events, generated content — are deleted with it. To delete your account, email [email protected].

Your rights

You can access and correct your account information in settings. You can also ask us to access, correct, export, or delete the personal data we hold about you by contacting [email protected]. We respond to every verified request.

Children

EchoRanked is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children.

Changes to this policy

If we change this policy, we will update this page and the date at the top. Material changes will be announced in the product or by email before they take effect.

Contact

Questions about privacy? Email [email protected].