Privacy policy

allclicks is a dashboard that shows Google Search Console performance numbers (clicks, impressions, CTR and position) for the sites you already have access to, side by side.

When you sign in with Google we receive your name, email address and profile picture, only to sign you in and show who is signed in. With your permission we also get read-only access to your Search Console data (the webmasters.readonly permission). We can read it; we cannot change anything in your Search Console.

We keep your e-mail address and the dates you used the service, only to count how many people use it and to be able to tell you about changes to the service. Your tags are stored the same way, keyed to your account. Visits to the public pages are counted by Vercel Web Analytics, which does not use cookies and does not record which of your sites you look at.

Search Console data is requested from Google when you open a page and is shown to you. It is kept only in short-lived server memory (minutes to a few hours) to make pages load faster, and is not written to a database, except for index tracking, which you turn on yourself for a site (see below). Results of index checks you run by hand are kept only in your browser, for up to 30 days.

• A sign-in cookie in your browser. It holds your Google sign-in token (encrypted) so you stay signed in for up to 90 days.
• Preference cookies (Needs attention settings, folded blocks).
• The date you last opened allclicks, under an identifier derived from your email address (used to pause index tracking while you are away).
• Your tags (their names, colors and the list of sites in them) in our database, under an identifier derived from your email address, so they follow you between browsers.
• For each AI app you connect (see below): the app’s name, when you connected it and last used it, and your Google sign-in token, encrypted, until you disconnect the app.
• For each extra Google account you link in Settings: its email address, when you linked it, its Google sign-in token (encrypted with AES-256-GCM, used to read that account’s Search Console properties) and which of your properties come from it. Unlinking the account deletes all of this at once.
• For each site with index tracking on (see below): its page addresses, their index status and history.
• Notes you add to a site’s chart (the day and your text), until you delete them.

On a site’s Indexing tab you can turn on daily index tracking. Nothing is tracked unless you turn it on. Once a day, allclicks reads the site’s sitemap and asks Google’s URL Inspection API about up to 1,000 of its pages (a larger sitemap is checked in turns, up to 5,000 pages in all). To do this while you are not on our site, we keep your Google sign-in token for that site, encrypted (AES-256-GCM) in our database.

For each tracked site we store the page addresses with their last index status (Google’s verdict, the last crawl date and the canonical address), a list of changes (up to 1,000) and daily counts for up to 400 days. Clicks and impressions are not stored; they are read from Google when you open the page.

Notable changes (pages that dropped out of or came into the index, a falling share of indexed pages) are kept as notifications under the bell in the app, up to the latest 200; they are not sent anywhere else. When you stop tracking a site, its token, statuses, changes, counts and notifications are deleted at once. If Google no longer accepts the token, tracking pauses until you turn it on again. If you do not open allclicks for 90 days, the daily checks pause and start again after your next visit.

You can connect allclicks to an AI app you use, such as Claude, ChatGPT or Cursor, through our MCP server. Nothing is connected unless you start it in the AI app, sign in with Google and click Allow on our consent screen. The app then gets the same read-only access to your Search Console data as the dashboard: the list of your sites and tags, and clicks, impressions, CTR and position with queries, pages, countries, devices and dates, including traffic from Google Discover and Google News, and Google's index status of the pages it asks about (URL Inspection). If you also allow tag editing on that screen, the app can create, rename, recolor and delete your allclicks tags and add or remove sites in them, the same way you can in the dashboard. It can never change anything in your Search Console.

To answer the app while you are not on our site, we keep your Google sign-in token for that connection, encrypted (AES-256-GCM) in our database. Search Console data is sent only to the app you connected, only in answer to its requests, and is not written to our database. Once the app receives the data, its own terms and privacy policy apply. We do not use your data to train AI models.

You can see every connected app and disconnect it in Settings at any time; its access stops at once and its stored token is deleted. Removing allclicks in your Google Account permissions ends every connection too.

You can create a team or join one with an invite link. A team stores its name, its members’ email addresses and roles, its invite links (valid for 7 days), the properties members added, and which people may open each of its tags. For each property we keep the Google sign-in token of the account it was added from, encrypted (AES-256-GCM), and use it to show that property’s data to the members allowed to see it. The team’s tags, chart notes, page groups, brand words and index tracking are shared by its members. Index tracking notifications of a team go to every member.

When you leave a team or are removed, the properties you added and their tokens are deleted from it. When a property is removed, its token is deleted and its index tracking stops. When the owner deletes a team, all of the above is deleted at once. An AI app connected to a team stops working when you are no longer in it.

We do not sell your data, share it with third parties, or use it for advertising. The service runs on Vercel (hosting) and Upstash (the database), which process data only on our behalf. When you connect an AI app, we send your Search Console data to that app at your request, as described above.

allclicks’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can sign out at any time, and revoke access in your Google Account permissions. You can also delete your saved tags, disconnect AI apps and stop index tracking at any time in the app.