Privacy policy

A small website footprint

The website code does not add advertising trackers, analytics scripts, email collection forms, or marketing cookies. It stores your language choice in your browser's local storage so the next visit can use the same language. You can remove that preference through your browser settings.

Website hosting providers include Vercel and, for the earlier product preview, OpenAI Sites on Cloudflare infrastructure. Hosting providers may process technical request information, such as your IP address, requested page, time of access, and browser information, and use necessary access or security cookies to deliver and protect the website. Their services have their own privacy practices. Following an external link takes you to a separate service. Contact links open your own email app.

What stays in your workspace

The app stores the projects, websites, questions, settings, and notes you add, along with collected answers, citations, page excerpts, optional screenshots, search and analytics snapshots, reports, and task history. Records can include source URLs, dates, request and response details, and integrity hashes used to explain where a finding came from.

This workspace is stored locally. The desktop app does not automatically upload the workspace to a getaudit cloud account. Background tasks run on your computer; they still contact the external services needed for the work you start.

When you connect Google

Google sign-in opens in your browser. With your permission, getaudit receives your Google account identifier, name, and email to show the connected account and keep connections associated with the correct account. getaudit does not receive your Google password.

The connection requests read-only access to Google Search Console and Google Analytics. Search Console data can include accessible properties and permission levels, queries and page URLs, clicks, impressions, click-through rates, average positions, dates, countries, devices, sitemaps, and URL inspection results. Analytics data can include accessible GA4 account and property details and aggregate reports such as active users, sessions, page views, key events, dates, and traffic sources.

You choose the properties to use in a project. Available features depend on the permissions you grant and the properties your Google account can access. These permissions do not let getaudit change your Search Console or Analytics configuration, and the connection does not request access to Gmail, Drive, or Contacts.

What we use Google data for

getaudit uses the Google data you authorize to show your search and analytics results, save dated evidence, help you identify research opportunities, and prepare the comparisons, analyses, and reports you request. Authorizing Google access alone does not start an AI analysis or publish your data.

Our handling of Google API data, including derived information, is subject to the Google API Services User Data Policy and its Limited Use requirements. We do not sell Google user data, use it for advertising or credit decisions, or use it to train or fine-tune general-purpose AI models. We do not give people access to read it except with your agreement to specific support access, when necessary for security, or when required by law. Optional transfers for the features below occur at your direction.

Searches and research services you choose

When you run collection, the selected service receives the questions or search terms and the request settings needed to answer them. Optional API connections include OpenAI, Google Gemini, Anthropic, Perplexity, and DataForSEO. Public page research also sends requests to the websites being inspected. Those services receive normal connection information, such as your IP address, and process requests under their own terms and privacy policies.

Browser collection uses separate temporary browser sessions rather than your personal browser profile. Strict guest collection does not reuse a prepared signed-in session. If you choose a supported signed-in mode, you sign in within its separate session. The visited platforms can use cookies and session storage there. Their account, request retention, and training settings are separate from the getaudit website's cookie practices.

Optional AI analysis

When you request an AI interpretation of collected answers, getaudit sends the selected questions, answer excerpts, and research context to the configured OpenAI API. Keyword audits send the selected search terms to DataForSEO and send the selected keywords, their Search Console average positions, relevant URLs, and page excerpts to your selected OpenAI or Anthropic model. Model inputs and outputs can also be saved in your local research history.

These requests provide the analysis you choose. getaudit does not operate a model-training service. A provider's processing, retention, location, and account settings can differ, and requests may be processed outside your country. Review them before sending confidential material. Use Google-derived data only with services and settings that keep its use within the disclosed analysis and Google's Limited Use requirements. A request setting that disables response storage does not establish that every provider log or retention period is disabled.

Agents get the access you grant

You can create a project-scoped access key to connect an agent or MCP client to your local workspace. Its default access is read-only. It can read the selected projects' available evidence, which can include saved Search Console queries and performance data. You can separately allow it to append an analysis; that permission does not let it change source evidence, start collection or paid work, edit your website, or publish.

A connected client can pass retrieved information to its own AI provider or other services according to that client's configuration. Choose the client and its permissions carefully. You can revoke the key to stop further access; revocation does not remove information the client has already received.

Exports, sharing, and copies

Reports, backups, exports, and sharing features can contain the evidence and website or analytics data you include. You decide whether to create or distribute them. Anyone you give a usable report file, share link, key, or passphrase may be able to read the corresponding content. Revoking a share stops later access through that share; it cannot recall copies already downloaded or sent elsewhere.

How local storage is protected

The packaged desktop app uses operating-system-backed encryption for saved connection credentials and Google session tokens. Short-lived Google access tokens are used in memory for API requests. Google authorization uses a browser return to the local app, PKCE, state and nonce checks, and signed identity-token verification. External API requests use HTTPS.

The local evidence database, reports, screenshots, and database backups are not all encrypted by getaudit. Their protection also depends on your computer, user account, disk encryption, backup settings, and any location where you copy them. Do not share connection files, agent keys, passwords, or access tokens with a report or support request.

Disconnecting and deleting are different

Signing out of Google in getaudit removes the current Google session from the app's saved connection storage and stops that connection from making new reads. It does not erase saved research, exports, or backups, sign you out of Google in your browser, or revoke the grant held by Google. You can remove getaudit's access separately through your Google Account connections settings.

Deleting a project in the app is a restorable action that hides it from active work. It does not permanently erase its evidence history. Uninstalling the app may also leave local application data behind.

To erase a local workspace completely, its stored application data and any copies, exports, backups, or separately retained files need to be removed. Contact us if you need help locating those records. Removing local data does not delete the original data held by Google or another provider.

Retention and support

Saved research is retained locally as an evidence history; the app does not apply an automatic expiry period to those records. Your own backups and copies have their own lifecycle. External providers and the website host apply their own retention practices.

If you email us, we receive the contact details and content you choose to send. We use them to respond and handle the request. Privacy questions and requests to access, correct, or delete information we hold can be sent to max@maxuod.com. We may need enough information to verify and locate your request. We cannot remotely erase a workspace that exists only on your computer.

When this policy changes

We will update the date on this page when the policy changes. If we introduce a new use of Google user data, we will explain it and obtain any required consent before using the data that way.