Privacy Policy

Introduction

This Privacy Policy explains how TriRank ("we", "us", "our") collects, uses, stores, and protects your information when you use our services at trirankai.com. It includes a dedicated section describing how we handle data obtained from Google Search Console when you choose to connect your account.

Information We Collect

• Account Information: Name, email address, and authentication details you provide when registering or signing in (including via Google or GitHub sign-in).
• Usage Data: Information about how you interact with our application, such as pages visited and features used.
• Device Information: Technical details such as IP address, browser type, and operating system.
• Connected Data Sources: When you connect a data source such as Google Search Console, we collect performance data from that source as described below.

Google User Data (Google Search Console)

TriRank lets you connect your Google Search Console account so we can show you how your own websites perform in Google Search. This section describes exactly how we handle that data.

What we access

When you connect Google Search Console, you grant TriRank the read-only scope https://www.googleapis.com/auth/webmasters.readonly. Using this scope we access:

• The list of Search Console properties your Google account can access, so you can choose which site to analyze.
• Search Analytics performance data for the properties you choose: search queries, landing pages, clicks, impressions, click-through rate (CTR), and average position, broken down by date.

We request only this single read-only scope. We never request write access, and we cannot modify, add to, or delete anything in your Search Console account.

How we access it

Authorization uses Google's OAuth 2.0 web-server flow with offline access, so TriRank receives a refresh token that lets it fetch your latest performance data on your behalf. We never see or store your Google password.

How we store it

• Your Google OAuth refresh token is encrypted at rest using AES-256-GCM before it is stored. The encryption key is held separately as a server secret and is never exposed or logged.
• The performance metrics we retrieve (queries, pages, clicks, impressions, CTR, and position) are stored in our database so we can display your trends and reports over time.

How we use it

We use your Search Console data solely to provide the TriRank features you request — your rankings, keyword opportunities, and performance reports — so you can see how your own sites perform. We do not:

• sell your Google user data;
• transfer it to third parties except sub-processors strictly necessary to operate the service;
• use it for advertising; or
• use it to develop, improve, or train generalized artificial intelligence or machine-learning models.

Our sub-processors for Google user data are: Cloudflare (hosting and infrastructure), Anthropic (AI content generation — receives only the target keyword a user or their pipeline selects, never raw Search Console metrics), and Perplexity (AI-visibility checks — receives only derived search query strings used to test whether AI engines cite the user's site, never metric values).

You may also choose to create a public share link (/r/<token>) for a site's report. While that link is active, anyone holding it can see the aggregated, derived metrics for the site you selected — rankings, clicks, and AI-citation statistics — without signing in. A share link never exposes your Search Console credentials, your OAuth token, or your other sites. You create these links yourself, they are never generated automatically, and you can revoke one at any time; revocation takes effect immediately and the link stops working.

Data retention and deletion

We retain the Search Console performance data we collect so we can show you historical trends over time. You can disconnect Google Search Console at any time from the Connections page; disconnecting immediately and permanently deletes the stored, encrypted authorization token, and no further data is retrieved. To delete the performance data we have already collected, delete your account or contact us, and we will remove it.

Limited Use disclosure

TriRank's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

The TriRank Browser Extension

The TriRank extension for Chrome shows what AI engines already know about the site you are viewing, and tests whether AI crawlers can reach it. It has no account and no sign-in, and nothing it does can be tied to an identity, because it never sends us one. This section describes exactly what it reads, what leaves your device, and what it stores.

What it reads

When you click the TriRank toolbar icon, the extension reads the page you are on after its JavaScript has run, so that it sees the page a reader sees rather than the raw HTML. It collects the page's structure and metadata — not your interaction with it:

• headings: their levels, their order, and their text;
• the page's title, meta description, meta robots directive, canonical link, viewport, and HTML lang;
• Open Graph and Twitter card tags, and the site name they declare;
• structured data (JSON-LD) blocks, copied under fixed limits on depth, number of fields, value length, and array size — the panel shows how much each limit dropped;
• links: up to 150 of them, with their targets and up to 120 characters of anchor text;
• images: up to 100 of them, with their alt and title text;
• counts that describe the page's shape: lists, list items, tables, table rows, numerals, and how much of the heading text is CJK;
• the page's robots directives, hreflang annotations, declared sitemaps, and whether an llms.txt is published, which it reads by requesting robots.txt, llms.txt and the sitemaps from the site itself;
• the page's full address, including any query string.

It does not read form fields, input values, cookies, browser storage, or anything on a page where you have not opened the panel.

How it reads it

The extension has no standing access to your browsing. It relies on Chrome's activeTab permission, which Chrome grants only at the moment you click the toolbar icon and revokes as soon as you navigate away. There is no content script running in the background, and no list of sites it watches. If you never click the icon on a page, the extension never sees that page.

To read the page after its scripts have run, it runs a single read-only function inside the tab. That function only reads: it does not modify the page, inject anything into it, or act on the page on your behalf.

What leaves your device

Only the domain name. When the panel opens, the extension asks TriRank what we already know about that domain, at /api/signals/<domain> and /api/site-cache/<domain>. The domain name is the entire request: no path, no query string, no page content, and no identifier for you.

Both requests omit credentials, so no cookies are sent — including any TriRank cookie you may hold from being signed in on our website. We therefore cannot tell who made the request, and we cannot link it to a TriRank account.

Everything listed under "What it reads" stays on your device. It is passed from the extension's background worker to the extension's own panel and is never uploaded: no request the extension makes carries it, and it is never written anywhere outside your browser.

Both endpoints answer only from what we have already stored. They never start a new measurement, so opening the panel on a site does not cause us to go and crawl or analyze it.

The crawler reachability test

This is the one part of the extension that requests something from the site you are viewing under another party's name, and it deserves to be described plainly, because those requests appear in that site's server logs as coming from an AI crawler. Reading robots.txt, llms.txt and the sitemaps also reaches the site and also appears in its logs — but as an ordinary request from your browser, not as somebody else.

When you press the reachability button, the extension asks the site for its robots.txt, and then, for each AI crawler, requests the current page while identifying itself as that crawler — for example as GPTBot or PerplexityBot. That is the only way to learn what a site actually returns to those crawlers, rather than what it declares. If you run this on a site you do not operate, its operator will see those requests in their logs.

Three limits are built into it:

• Your cookies never ride along. The requests omit credentials, so your own session with that site is never sent out under a crawler's name.
• A crawler that robots.txt has already turned away is not impersonated. Where the site's robots.txt disallows a crawler, the extension records that and skips the request rather than sending it anyway.
• We never invent a User-Agent. Of the nine crawlers the panel reports on, only the five whose operators publish a User-Agent string are actually requested. For the other four the extension reports what robots.txt says and states plainly that it did not test them.

The test runs only when you press the button. It is never triggered automatically, and the same page is not re-tested within ten minutes.

What it stores, and for how long

The extension stores what it reads in Chrome's session storage, which the browser clears when it closes. It never uses synced storage, so nothing it holds is copied to your other devices.

Two things are kept there: the address of the tab the panel was opened on, and the result of a crawler reachability test, which is reused for ten minutes so that reopening the panel on the same page does not send that site a second round of crawler requests.

One setting is kept longer, on purpose. Your choice of light or dark theme is written to local storage on this device, so the panel opens the way you left it — it is the one thing here that survives a browser restart, and it stays until you change it or clear the extension's data. It is never uploaded, and because it is local rather than synced storage it is not copied to your other devices.

What it does not do

• No account, no sign-in, and no way to connect its activity to a TriRank user.
• No analytics, telemetry, crash reporting, or usage tracking of any kind.
• No advertising, no selling or sharing of what it reads, and no use of it to train models.
• No remote code: everything it runs ships inside the extension package.

How We Use Your Information

Beyond the Google data described above, we use your information to:

• provide and maintain our services;
• authenticate you and keep your account secure;
• provide customer support;
• communicate service updates; and
• detect, prevent, and address technical issues.

Data Security

We implement appropriate technical and organizational measures to protect your information, including encryption of sensitive credentials at rest and encrypted transport (HTTPS). No method of transmission or storage is completely secure, but we work to protect your data using industry-standard practices.

Third-Party Services

We rely on third-party sub-processors to operate our service (for example, infrastructure hosting, email delivery, and payment processing). These providers process data only as needed to perform services on our behalf and are bound by confidentiality obligations.

Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data. You can disconnect data sources at any time, and you can delete your account from your account settings. To exercise any of these rights, contact us.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the date above.

Contact Us

If you have any questions about this Privacy Policy, please contact us.