Privacy Policy

Effective July 28, 2026

This policy explains what RankTruck collects, why, and who touches it. The short version: we collect what the product needs to do its job for your business, we do not sell it, and we do not use it for advertising.

What we collect

• Your account: name, email address, and a hashed password. We never store the password itself. If you choose text-message sign-in codes, your own mobile number as well.
• Your business profile: the details you enter during setup, such as services, cities, phone and website.
• Notes you choose to add: writing samples and local knowledge used to draft your content.
• Performance data the service gathers for you: search rankings, reviews and their text, listing details, website health results, backlink counts, and analytics from accounts you connect.
• Customer contact details for review requests: the phone number of a customer you text, and a short note that rides along with it. You type that note yourself, or your job software supplies it when a job is finished, and it is usually the job rather than the person, such as “Northvale driveway”. It is a free-text field, so whatever you put in it is what we store. We never ask you for your customer’s name.
• Operational records: logs of the jobs your instance runs and the service’s own usage costs.

Google account access

If you connect Google services, you do so on Google’s own consent screen and can revoke access at any time at myaccount.google.com. We store the resulting tokens on your instance and use them only for the features you connected: reading Search Console data (over the permission Google bundles with sitemap submission), submitting page addresses to Google’s Indexing API so newly published pages are looked at, reading Analytics data, and managing your Business Profile. Use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Where your data lives

Each customer runs on their own instance with their own database, hosted in the United States on encrypted storage. Your dashboard, your database and your backups are yours alone: nothing of another customer’s is in them, and no other customer’s instance can read them. Backups are taken continuously and stored encrypted.

The companies we send through are shared, and it is worth being plain about that. Texts go out through one RankTruck account at Twilio. Our email goes out through one mail account. The lookups behind your rankings and the twice-weekly AI checks are billed to one RankTruck account at each provider. So those companies hold the record of that sending and those lookups in one account, with every customer’s together, under our name. No customer can see another customer’s, and none of it puts your data in anyone else’s dashboard.

Who processes data for us

We use a small set of providers to run the service. Each receives only what its role requires:

• Fly.io hosts your instance (US regions).
• Cloudflare stores encrypted backups.
• Stripe takes your payment and holds your card details. We never see the card number.
• Anthropic writes the drafts. That covers your blog posts and town pages, your Google listing posts and your answers to questions on that listing, your review replies, the suggested searches and the setup notes made when you join, descriptions of the pictures used in posts, and your weekly summary, which is written from the rankings, reviews and suggestions on your dashboard. Where a draft quotes one of your reviews, that review text goes with it.
• Google provides the APIs for the accounts you connect, checks your website’s speed and health, answers one of the twice-weekly AI checks with Gemini, and makes a picture for a post when you ask for one.
• DataForSEO performs the search-result lookups behind rank tracking and the count of other websites linking to yours, and puts four of the five twice-weekly AI checks to the AI tools on our behalf.
• Twilio delivers your text messages: account alerts and sign-in codes if you pick texts for those, and the review-request texts that go to your customers.
• Pexels supplies stock photography for posts.
• OpenStreetMap’s geocoder converts your city names to map coordinates once, during setup.

The twice-weekly AI check works like this. We put the questions your customers ask to five AI tools and write down whether your business got named. Four of them we reach through DataForSEO: ChatGPT, Perplexity, Claude, and the AI answer Google puts at the top of its own results. DataForSEO is the company that receives those four questions. The fifth is Gemini, which we ask Google directly. Each question is the kind of thing a customer types: the work you do plus one of the towns you serve. It goes out with the town it is about. Your business name is what we look for in the answer that comes back.

We do not sell your data, share it with advertisers, or use it to train models.

Review requests

If you turn on review requests, the service texts your customer and asks them to leave a review. The phone number and the note come from you or from your connected job software, and the message goes out through Twilio between 9am and 7pm your time. The message never uses your customer’s name, because we do not have it. If they have not opened the link after three days, one follow-up goes out, and that is the end of it. The phone number and the note are deleted 14 days after the request is queued. After that we keep only a scrambled fingerprint of the number, never the number itself, so the same number is not texted again for three months and so anyone who replies to opt out stays opted out.

Cookies

The service sets only its own cookies: one keeps you signed in, one remembers whether you chose the light or dark screen, and one remembers a device you ticked to trust for sign-in codes. Connecting a Google account sets one more for ten minutes while you are on Google’s screen. There are no third-party tracking cookies and no advertising pixels.

How long we keep things

• Raw search-result payloads are pruned after 90 days; the ranking history built from them is kept so your charts stay complete.
• Customer names and phone numbers used for review requests are deleted 14 days after the request is queued; only the scrambled opt-out fingerprint is kept.
• Everything else is kept while your account is active, because it is the working data of your instance.
• Thirty days after your account ends, your instance and its backups are deleted. Before then, ask and we will give you a full export.

Your choices

• Export: request a copy of your data at any time.
• Deletion: cancel and your data is deleted on the schedule above, or ask us to delete sooner.
• Google access: revoke at myaccount.google.com whenever you like; the connected features simply stop.
• Alerts: choose where alerts go, or turn them off.

Changes

If this policy changes in a way that matters, we will email you before the change takes effect.

Contact

Privacy questions: support@ranktruck.com.