Privacy Policy

Effective September 23, 2026

This policy explains what RankTruck collects, why, and who touches it. The short version: we collect what the product needs to do its job for your business, we do not sell it, and we do not use it for advertising.

What we collect

• Your account: name, email address, and a hashed password. We never store the password itself.
• Your business profile: the details you enter during setup, such as services, cities, phone and website.
• Notes you choose to add: writing samples and local knowledge used to draft your content.
• Performance data the service gathers for you: search rankings, reviews and their text, listing details, website health results, backlink counts, and analytics from accounts you connect.
• Operational records: logs of the jobs your instance runs and the service’s own usage costs.

Google account access

If you connect Google services, you do so on Google’s own consent screen and can revoke access at any time at myaccount.google.com. We store the resulting tokens on your instance and use them only for the features you connected: reading Search Console data (over the permission Google bundles with sitemap submission), submitting page addresses to Google’s Indexing API so newly published pages are looked at, reading Analytics data, and managing your Business Profile. Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Where your data lives

Each customer runs on their own instance with their own database, hosted in the United States on encrypted storage. Your dashboard, your database and your backups are yours alone: nothing of another customer’s is in them, and no other customer’s instance can read them. Backups are taken continuously and stored encrypted.

The companies we send through are shared, and it is worth being plain about that. Our email goes out through one mail account. The lookups behind your rankings and the weekly AI checks are billed to one RankTruck account at each provider. So those companies hold the record of that sending and those lookups in one account, with every customer’s together, under our name. No customer can see another customer’s, and none of it puts your data in anyone else’s dashboard.

Who processes data for us

We use a small set of providers to run the service. Each receives only what its role requires:

• Fly.io hosts your instance (US regions).
• Cloudflare stores encrypted backups.
• Stripe takes your payment and holds your card details. We never see the card number.
• Anthropic writes the drafts. That covers your blog posts and town pages, your Google listing posts and your answers to questions on that listing, your review replies, the suggested searches and the setup notes made when you join, descriptions of the pictures used in posts, and your weekly summary, which is written from the rankings, reviews and suggestions on your dashboard. Where a draft quotes one of your reviews, that review text goes with it.
• Google provides the APIs for the accounts you connect, checks your website’s speed and health, answers one of the weekly AI checks with Gemini, and makes a picture for a post when you ask for one.
• DataForSEO performs the search-result lookups behind rank tracking and the count of other websites linking to yours, and puts four of the five weekly AI checks to the AI tools on our behalf.
• Pexels supplies stock photography for posts.
• OpenStreetMap’s geocoder converts your city names to map coordinates once, during setup.

The weekly AI check works like this. We put the questions your customers ask to five AI tools and write down whether your business got named. Four of them we reach through DataForSEO: ChatGPT, Perplexity, Claude, and the AI answer Google puts at the top of its own results. DataForSEO is the company that receives those four questions. The fifth is Gemini, which we ask Google directly. Each question is the kind of thing a customer types: the work you do plus one of the towns you serve. It goes out with the town it is about. Your business name is what we look for in the answer that comes back.

We do not sell your data, share it with advertisers, or use it to train models.

Cookies

The service sets only its own cookies: one keeps you signed in, one remembers whether you chose the light or dark screen, and one remembers a device you ticked to trust for sign-in codes. Connecting a Google account sets one more for ten minutes while you are on Google’s screen. There are no third-party tracking cookies and no advertising pixels.

How long we keep things

• Raw search-result payloads are pruned after 90 days; the ranking history built from them is kept so your charts stay complete.
• Everything else is kept while your account is active, because it is the working data of your instance.
• Thirty days after your account ends, your instance and its backups are deleted. Before then, ask and we will give you a full export.

Your choices

• Export: request a copy of your data at any time.
• Deletion: cancel and your data is deleted on the schedule above, or ask us to delete sooner.
• Google access: revoke at myaccount.google.com whenever you like; the connected features simply stop.
• Alerts: choose the email address they go to.

Changes

If this policy changes in a way that matters, we will email you before the change takes effect.

Contact

Privacy questions: support@ranktruck.com.