What we keep, and who sees it

Your email address and a scrypt hash of your password. We never store the password itself.

The sites you add, and what the service collects about them: crawl and audit results, search and AI-visibility numbers from the accounts you connect, and visit events if you install the tracker on your site.

API keys you paste in (for example Bing Webmaster Tools or PostHog). They are encrypted with AES-256-GCM before they are written to the database.

If you connect Google, Growth Radar asks for read-only access to Search Console (webmasters.readonly) and, if you choose, Google Analytics (analytics.readonly), plus your basic profile and email to identify the account. It reads search performance and analytics reports for the sites you add, stores them in your account and shows them back to you. It never changes anything in your Google accounts.

The refresh token is encrypted at rest. It is not sold, not used for advertising, not shared with anyone except the service providers listed below that run Growth Radar, and not used to train general AI models. You can revoke access at any time in your Google Account (myaccount.google.com/permissions) or by disconnecting in Settings.

Growth Radar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google and Bing do not offer an API for their AI reports (Search Console's AI features report and Bing's AI Performance report). If you add Growth Radar's read-only delegate account as a user on your Search Console or Bing Webmaster property, Growth Radar reads those reports for that property only, after checking through your own connection that you own it. Remove the delegate user to stop this at any time.

Your sites, numbers and keys are visible only to your account. Every page and API call is scoped to the signed-in account, and other accounts cannot read or change your data.

The operator of Growth Radar can access the database to run and repair the service.

Vercel hosts the app. Neon hosts the database, in the EU (Frankfurt). Railway hosts the Umami analytics server and the feedback widget. If invites are emailed, Resend delivers them.

When the insight and AI-citation jobs run, your site's address, its top search queries and their numbers, and other aggregated metrics are sent to a model provider (Anthropic or OpenRouter) to write findings.

Speed checks send your public page addresses to Google PageSpeed Insights.

Visit data from the Growth Radar tracker is kept for 12 months by default, and then deleted.

Anyone can ask for a check of a public website by typing its address. The check reads only what any visitor or search engine can read: the homepage, robots.txt, llms.txt and the sitemap, using the GrowthRadarAudit user agent. It sends the homepage address to Google PageSpeed Insights for the phone speed test.

The result is stored under the site's address and shown to anyone who opens that result page. Those pages are hidden from search engines. A newer check of the same site replaces the old result. We keep each result for up to 12 months and then delete it automatically. If you run the site and want its result removed sooner, write to us and we remove it on request.

To stop abuse, the IP address of the person asking is used for rate limiting. Only a one-way hash of it is stored, and those records are deleted after about a day.

If you join the waitlist we store your email address, which button you used, the page that sent you, campaign tags in the link, and your answer if you add one. We use it to send your status link and, later, an invite. Ask us and we delete it.

We sometimes email a business about renovating its website. We use contact details the business publishes itself, on its own site or in public business listings, and only for a business purpose. We may build a free preview of a new homepage from the public content of the business's site; it is hidden from search engines and removed after 14 days, or straight away on request.

We keep the business name, address of the site, the contact details we used and what we sent, so that we do not write twice and can honour a request to stop. To stop hearing from us or to have this deleted, reply to the email or write to outreach@growthradar.app. In the UK, the basis for this is our legitimate interest in offering a service to businesses, and you can object at any time.

For visitors to a client's website, the client decides what is collected and is responsible for it; we process that data for them. The Website services terms say what our analytics records there, how long it is kept and who helps us run it. Visitors to those sites should contact the business that runs the site first.

Growth Radar's own pages, including this one, are measured with PostHog (EU), Google Analytics 4, Umami and Growth Radar's own tracker. They set cookies or local storage to count visits.

Session replay may record pages other than sign-in and the invite page, with every form input masked. The feedback widget does not load on those two pages either.

A session cookie that keeps you signed in, and a one-hour cookie that holds your invite while you create your account. Both are HTTP-only.

To have your account and everything stored for it deleted, reply to the message your invite link came in. Disconnecting a key in Settings removes it straight away.