Privacy Policy

This policy explains what SerpSummary (the website, dashboard and Chrome extension) collects, why, and what you can do about it. We don't sell your data and we don't run advertising trackers.

What we collect

• Account details — your name and email address. If you sign up with a password we store only a salted scrypt hash of it; if you use “Continue with Google” we store your Google account ID.
• Plan and usage — your plan, credit balance, trial end date, and a log of each lookup (which tool, how many items, credits charged). This log does not contain your search terms.
• Your research — keywords and domains you look up, their results, your search history and saved lists, so the dashboard can show them back to you. Incognito mode (24 hours, from the extension or Settings) stops us saving searches and history.
• Security events — sign-ins, failed sign-ins, password changes and extension connections, with the IP address they came from, to protect your account.
• Your devices — for each signed-in browser and connected extension: the IP address it was opened from and last used from, its browser and operating system (from the User-Agent header), the extension version, and when it was last used. We look up which organisation owns each IP address in the public internet registries (RDAP). This protects your account and helps us spot abuse of free trials.
• Error reports — when the dashboard crashes or the extension hits an error, we record the site's hostname (e.g. www.google.com), the page path on our dashboard, the error message and technical details. Never your search query.
• Your own AI key — only if you add one in Settings or the extension: the provider, model and the key itself, encrypted (AES-256-GCM). We use it only to run the AI features you open, show only its last 4 characters, and delete it when you remove it or delete your account.
• Billing — if you subscribe, Stripe processes your payment. We store only the Stripe customer and subscription IDs and the payment events Stripe sends us; we never see your full card number.

The Chrome extension

The extension only works on Google search results pages. When you search, it reads the results page you are already looking at and sends the query, your Google location/language and the result URLs to our API to fetch metrics. It never runs extra searches on its own — pages 2–3 load only when you click “Add pages 2–3”.

To build rank history we keep one shared snapshot per query, location and day of the public results page (titles, URLs and snippets). That snapshot is not linked to your account or to who searched.

The extension connects to your account with a token it receives after you approve a short code in your dashboard. We store only a hash of that token, and you can disconnect at any time.

The extension's “Search location” window shows an OpenStreetMap map. When you type an address and click Geocode, or click the map, your browser sends that address or point straight to OpenStreetMap's Nominatim service to look it up, and loads map tiles from OpenStreetMap. We never receive the address. The last point you searched from is kept in the extension's local storage on your computer.

Services we send data to

To produce metrics we send the keywords, domains or URLs you look up — not your name or email — to:

• Google (Ads API for volume and CPC, Autocomplete, Chrome UX Report and PageSpeed Insights, Safe Browsing)
• Keywords Everywhere (search volume, CPC, trends, keyword ideas, ranking keywords, traffic and backlinks)
• Ahrefs, Moz and Open PageRank (domain authority, links and popularity)
• Groq (AI SERP insights and search-intent labels — it receives the query and public result text)
• If you add your own AI key in Settings: the AI provider you chose (Groq, xAI, OpenAI, Cerebras, Anthropic or Google Gemini) instead of our Groq account — it receives the same AI prompts, sent with your key
• Public web sources: the sites themselves (robots.txt, sitemaps, page markup), the Wayback Machine, RDAP registries (domain ages, and the owners of your devices' IP addresses), certificate-transparency logs (Cert Spotter, crt.sh) for subdomains, and Wikidata (it receives the names found in public search results, to say whether each is a person, place, organisation or product)

Some rankings come from open datasets we download and store ourselves, so nothing you look up is sent to them: the Tranco list, the Chrome UX Report, the Common Crawl web graph and the Majestic Million, which Majestic licenses under CC BY 3.0.

We also use Stripe for payments and Resend to send password-reset emails (it receives your email address). The sign-in and sign-up forms use Cloudflare Turnstile to block bots; it runs in your browser and receives your IP address and browser signals, not your email or password.

Cookies and storage

We set one essential, httpOnly cookie (kc_session) to keep you signed in. The dashboard remembers your light/dark theme in your browser's local storage. There are no advertising or analytics cookies.

How long we keep it

• Account data, search history and saved lists — until you delete them or close your account.
• Internal performance logs of calls to data providers, and error reports — 90 days.
• Device records — until you sign out of that browser or disconnect that extension, then kept with the account for security.
• Billing and security records — kept after an account is closed where we need them for accounting or fraud prevention.

Your choices

• Delete saved lists and search history yourself from the dashboard, at any time.
• Turn on incognito mode so searches aren't saved.
• Disconnect the extension from its popup.
• Ask for a copy of your data, a correction, or deletion of your account by contacting us at our contact page.

Changes

If we change what we collect, we'll update this page and the date at the top before the change takes effect.