Privacy policy

Last updated October 18, 2026

This covers what RankAfternoon collects when you use the website and the app, why we collect it, and who else ends up with some of it. If something here doesn't match what you see the app doing, email hello@example.com and we'll fix whichever one is wrong.

What you give us

When you sign up, we keep your email address and a hashed copy of your password (we can't read the password itself). If you open an agency account, we keep its name, the billing email you set, and the email addresses of anyone you invite.

When you start a report, we keep what you put in the form: your domain, where your customers are, your goals, how much you can publish, your website's language, and anything you write about your business or new topics you want to be found for.

What we gather to write a report

  • Your public pages. We fetch a small sample of pages from the domain you give us, the same way a browser would, plus a couple of competitor pages that show up in search results.
  • Keyword and search result data. We look up keywords and live search results related to your site through DataForSEO.
  • Google Search Console, only if you connect it. We ask Google for read-only access, plus the email address of the Google account you connect, so you can tell your connections apart. When you choose a property and opt in on a report, we take a snapshot of 28 days of search performance, capped at 100 queries and 100 pages. The tokens Google gives us are encrypted in our database. Disconnecting deletes them and tells Google to revoke them, and you can also revoke access from your Google account at any time.

We keep that evidence with the report it was gathered for, along with the finished report and its downloads. Archiving a report hides it from your account; it doesn't delete it. If you want it gone for real, email us.

Payments

Payments go through Stripe, PayPal or Creem, depending on which one you pick. They handle your card or account details, and none of that touches our servers. We keep a record of each payment: the amount, what it was for, whether it worked, and the processor's reference for it. If your account pays by invoice, we keep a record of what you owe instead.

How the site is used

We run our own analytics with an open source tool called Ahoy, and the data stays in our database. For each visit it records your IP address, your browser and device type, the page that sent you here, the pages you look at, the links and buttons you click, the forms you submit (which form, not what you typed into it), how far down a page you scroll, and how long you stay. We look up a rough location (country, region, city) and the network your IP address belongs to using MaxMind's GeoLite2 databases, which run on our servers, so your IP address isn't sent anywhere to do it.

Cookies

  • Signing in. A session cookie keeps you signed in, and a second cookie remembers you for longer if you tick "remember me". The app doesn't work without the session cookie.
  • Analytics. Ahoy sets ahoy_visit, which lasts 30 minutes from your last page, and ahoy_visitor, which lasts two years and lets us tell a returning visitor from a new one.

Blocking the analytics cookies doesn't break anything.

Who else gets your data

We don't sell your data, we don't run ads, and nobody pays us to see it. These are the companies that process some of it so the service works:

  • OpenAI writes the report. It receives your form answers, the pages we fetched, the keyword and search result data, and your Search Console snapshot if you opted in. OpenAI keeps what we send under its API data policies and, by default, doesn't train its models on it.
  • DataForSEO receives the keyword and search lookups for your site.
  • Google receives a request for your Search Console data, only if you connect it.
  • Stripe, PayPal and Creem receive what they need to take a payment, depending on which one you use. Creem acts as the merchant of record for purchases made through it.
  • Postmark sends our email: account confirmations, password resets, invitations, report notifications and billing notices.
  • Sentry receives error reports when something breaks, and those can include details of the request that broke, like your IP address and account.
  • Our hosting provider runs the servers and the database everything above lives in.

We'll also hand data over if the law makes us, and we'll tell you about it unless the law says we can't.

How long we keep it

Account data, reports and payment records stay for as long as your account is open, and payment records may stay longer because tax law says so. Analytics data stays for as long as it's useful for figuring out how the site gets used. If you close your account and want your data deleted, email us and we'll delete everything we're not legally required to keep.

Your choices

You can update your email and password from your profile, disconnect Google from settings, and ask us at any time for a copy of your data, a correction, or deletion. Email hello@example.com and a person will answer.

Changes

When this policy changes, the date at the top changes with it. If a change affects how we use data you've already given us, we'll email account admins before it takes effect.