Privacy Policy

Published October 26, 2026. Takes effect November 26, 2026 for accounts opened before this version was published, and on signup for accounts opened after it was published. Until November 26, 2026 an existing account is covered by the policy effective September 23, 2026; ask us and we will send you a copy.

This policy explains what RankTruck collects, why, and who touches it. The short version: we collect what the product needs to do its job for your business, we do not sell it, and we do not use it for advertising.

What we collect

• Your account: name, email address, a hashed password (we never store the password you choose), your two-step sign-in settings, and for each device you tick to trust, the description its browser sends.
• How you found us: when you sign up we keep the short code on the link you came in by (for example a partner’s), the name of the website you came from (only the site, never the page or anything you searched for), and your answer to “How did you hear about us?” if you gave one. We use them only to count which links bring signups, and they are kept with the rest of your account’s record, including when you start a signup and do not finish it.
• A record of your account activity: when you signed in and how (a password, a sign-in code, a backup code or a trusted device), when you signed out, when wrong tries locked your sign-in, changes to your password, sign-in codes, backup codes, trusted devices and alert email, when you agreed to our terms, changes to your website and Google connections, and when you used the billing buttons in Settings, such as cancelling. You can see the newest entries under Recent activity in Settings, and all of it is part of your data export. It does not hold the internet address or the browser you signed in from.
• Your business profile: the details you enter during setup or later in Settings, such as services, cities, phone and website. When you connect your Google listing during setup, empty details may be filled in from it, and you see them before anything is saved.
• The key you give us for your website (on WordPress, an application password). It is kept on your instance, used only as section 6 of our Terms describes, left out of your data export, and handed back when you disconnect your website or your account is paused.
• Notes you choose to add: writing samples and local knowledge used to draft your content.
• Performance data the service gathers for you: search rankings, reviews and their text, listing details, website health results, backlink counts, and analytics from accounts you connect.
• Operational records: logs of the jobs your instance runs and the service’s own usage costs, and a short summary your dashboard sends us every day: what is set up and connected, when you last signed in, which tasks failed and what it cost to run. To stop one place making many requests in a row to sign up, to open the billing page, to find a dashboard or to resend a dashboard link, we keep a scrambled key made from the internet address each request came from, never the address itself. Finding a dashboard and resending its link also keep a scrambled key made from the email address involved, so one inbox cannot be flooded. The keys are deleted within a few hours, though a nightly copy of our records taken in that time can keep them for up to a year.

Google account access

If you connect Google services, you do so on Google’s own consent screen and can revoke access at any time at myaccount.google.com. We store the keys Google gives us on your instance and use them only for the features you connected: reading Search Console data and Analytics data, for which we ask for read-only access, and managing your Business Profile. If you connected Google on or before October 10, 2026, your Google account may still list broader access for RankTruck, because we used to ask for more; we do not use it. Removing RankTruck at myaccount.google.com takes away all of its access at once, so the Google features stop until you connect again in Settings.

When you press Disconnect, we ask Google to cancel that access and delete our copy; if another connected feature still uses the same Google account, we delete only that feature’s copy until you disconnect the last one. When your account is paused, we ask Google to cancel all of it, and ask again every hour until Google confirms or your instance is deleted.

Some of what Search Console shows us leaves your instance. A search that showed your website can become the subject of a draft that Anthropic writes, along with how high your site came up for it and an estimate of the visits it could bring. Up to two of the weekly AI questions can also be worded from those searches (see the weekly AI check below). One of those searches that you choose to track, from your Keywords page, becomes one of your tracked searches and goes to DataForSEO and Anthropic like the rest of them. Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Where your data lives

Each customer runs on their own instance with their own database, hosted in the United States on encrypted storage. Your dashboard, your database and your backups are yours alone: nothing of another customer’s is in them, and no other customer’s instance can read them. Backups are taken continuously and stored encrypted.

The companies we send through are shared, and it is worth being plain about that. Our email goes out through one Google Workspace mail account. The lookups behind your rankings and the weekly AI checks, the drafts Anthropic writes, the pictures and speed checks Google makes and the photos from Pexels all run through one RankTruck account at each provider. So those companies hold the record of that sending and that work in one account, with every customer’s together, under our name. No customer can see another customer’s, and none of it puts your data in anyone else’s dashboard.

If we find that someone has reached your data without permission, we will email you within 72 hours of confirming it, saying what was reached, what we have done about it and anything you should do.

Who processes data for us

We use a small set of providers to run the service. Each receives only what its role requires:

• Fly.io hosts your instance (US regions).
• Cloudflare stores your encrypted backups, the pictures we make for your Google posts, your logo, and any copy of your data you ask for.
• Stripe takes your payment and holds your card details. We never see the card number.
• Anthropic writes the drafts. That covers your blog posts, including the ones about towns you serve, your Google listing posts, your review replies, the searches it suggests and the notes about your business and your towns that it drafts when you ask for them, descriptions of the pictures we make for your Google posts, and your weekly summary, which is written from the rankings, reviews and suggestions on your dashboard. With automatic publishing on, it also reads each piece against your business details before it goes out. Where a draft answers or quotes one of your reviews, that review text and the reviewer’s name go with it.
• Google runs the Google services you connect, checks your website’s speed and health, and makes a picture for a post when you ask for one.
• Google Workspace sends our email from support@ranktruck.com: your sign-in codes and password reset links, your alerts and reports, and the emails about your account and billing. Our mail account keeps a copy of each one.
• DataForSEO performs the search-result lookups behind rank tracking and the count of other websites linking to yours, looks up how often your tracked searches are made and which searches your website and your competitors’ websites show up for, and puts all five weekly AI checks to the AI tools on our behalf.
• Pexels supplies the stock photos in your blog posts.
• OpenStreetMap’s geocoder turns the names of the cities you serve, with their state, into map coordinates. It gets the whole list each time you save your cities, at setup or in Settings, and may get some of them again when you change your state.

The weekly AI check works like this. We put the questions your customers ask to five AI tools and write down whether your business got named: ChatGPT, Perplexity, Claude, Gemini, and the AI answer Google puts at the top of its own results. We reach all five through DataForSEO, the company that receives those questions and fetches each answer for us. Each question is the kind of thing a customer asks. Most name the work you do and one of the towns you serve, a few ask about the work alone, and for three of the tools we also say which of your towns the answer is for. If Search Console is connected, up to two of the questions can be worded from searches people made on Google that showed your website. Your business name is what we look for in the answer that comes back.

We do not sell your data, share it with advertisers, or use it to train models.

Cookies

The service sets only its own cookies. Three are for signing in: one keeps you signed in and lasts 30 days from the last time you use the dashboard, and two more that the sign-in needs last until you close your browser. One remembers whether you chose the light or dark screen, for a year. One remembers a device you ticked to trust for sign-in codes, for 30 days. After you reset your password, one more, which lasts 15 minutes, lets that browser sign in once even if wrong guesses have locked the account. Connecting a Google account sets one more for ten minutes while you are on Google’s screen. When you go to your dashboard through signin.ranktruck.com, that page sets one more, which remembers the dashboard address you used, for a year, so it can offer it next time. Changing your password, or pressing Sign out everywhere in Settings, means every other device has to sign in again before it can change anything. There are no third-party tracking cookies and no advertising pixels.

How long we keep things

• Raw search-result payloads are pruned after 90 days; the ranking history built from them is kept so your charts stay complete.
• Logs of the jobs your instance runs keep only the latest 100 runs of each job; older ones are deleted every week.
• In your account activity, sign-ins, sign-outs and locked sign-ins are deleted after a year, and backups of your dashboard can hold them for up to a year after that. The rest of that record is kept while your account is active.
• Everything else is kept while your account is active, because it is the working data of your instance.
• Thirty days after your account ends, your instance, its backups and the pictures stored for your posts are deleted. If you have asked for a copy of your data and we have not sent it yet, we wait until we have, for up to 14 days after we get your request.
• A short record of the account itself is kept after deletion: your business name, your account’s email address and its dashboard address (the one ending in ranktruck.com), its Stripe reference numbers, which version of our terms you agreed to, how you found us, its key dates, and the last daily summary your dashboard sent us. It is how a late message from Stripe about your account is recognised rather than acted on, and why that dashboard address is not given to anyone else. A signup that is started and never finished keeps a record like it too, though its dashboard address can then be used by someone else.
• Copies of the emails we sent you, any you sent us, and our own reports and alerts that name your account stay in our mail account after deletion.
• Stripe keeps its own records of your payments after deletion, under its own privacy policy.

Your choices

• Export: request a copy of your data at any time, and we email a download link to the address on your account.
• Deletion: cancel and your data is deleted on the schedule above, or ask us to delete sooner.
• Google access: press Disconnect in Settings, or revoke it at myaccount.google.com, whenever you like; the connected features simply stop.
• Alerts: choose the email address they go to.

Changes

If this policy changes in a way that matters, we will email you before the change takes effect.

Contact

Privacy questions: support@ranktruck.com.