Privacy Policy

AgentGEO is an independent project operated by an individual developer. It is not a registered company, and there is no legal entity or registered address behind it. Contact is by email only: for anything on this page, write to keronelau@gmail.com.

The service is a data plane. You send a prompt; we ask a managed AI-scraper provider to run it against surfaces such as ChatGPT, Perplexity, Gemini, Google AI Overview, Google AI Mode and Copilot; we return the answer text, citations and provider metadata. Rankings, sentiment and reporting happen in your own agent, not on our servers.

Sign-in is handled by Clerk, using either an email address and password or “Continue with Google”. When you use Google sign-in, Google returns your basic profile (such as your email address and name) to Clerk. Clerk is the system of record for that identity - your email address, your password credential, and your OAuth profile live in Clerk, not in our database.

Our API receives a signed Clerk session token, verifies it against Clerk’s public keys, and reads exactly one claim from it: sub, your Clerk user ID. Your workspace is then keyed as user_<sub>. That derived string is the only piece of your identity stored in our database - every row you own is tagged with it. We do not copy your email address, name or profile picture into our own storage.

Because Clerk holds your identity, Clerk’s own privacy practices apply to it in addition to this policy.

Each provider request carries four fields, and a fifth only for ChatGPT. This is the whole of it:

• prompt - your query text, verbatim
• url - the AI surface to run it against
• country and language - the locale you selected
• web_search - only for ChatGPT, and only when you set it

Nothing that identifies you accompanies that request. We do not send your Clerk user ID, your workspace ID, your email address, your API key or your IP address to Bright Data. The request authenticates as AgentGEO, using our own provider credential. From Bright Data’s side, the prompt is not attributed to you by us - but a prompt can of course identify you by its own content, which is why the warning above matters.

Bright Data returns the answer text and citations. We normalize that response into a stable record shape and store it (see below). We do not analyse, score, or train on it.

The site and the API run on Cloudflare (Workers, D1 and Cloudflare’s edge network). As our hosting and network provider, Cloudflare handles the connection data any web host handles, such as IP addresses and request metadata, under its own terms. We have Cloudflare Workers observability enabled, so our API’s operational logs are retained in Cloudflare. Those logs record identifiers (such as schedule IDs) and error messages; we do not write query or answer text to them deliberately, though we cannot promise an error message never contains a fragment of a request.

None of the tables above are shared with anyone beyond the sub-processors named on this page, and we do not sell data. The site does run analytics and advertising measurement scripts — what they are and what they see is the next section.

An earlier version of this page said this site ran no analytics of any kind. That stopped being true when we added product analytics, and it is further from true now that we advertise. This section replaces that claim.

• Our own event log. Same-origin, cookie-less, and stored by us. It records an event name (for example cta_playground_hero), the path, the referring URL, and a random ID held in sessionStorage that is discarded when you close the tab. It is deliberately not a persistent identifier and it carries no email, name or IP address.
• PostHog — product analytics. Records which pages and console features get used, plus Core Web Vitals and uncaught JavaScript errors. Traffic goes through this domain rather than directly to PostHog. When you are signed in we associate those events with your account ID and email so we can tell whether a feature actually gets used after signup. There is no session recording and no heatmap.
• Google Analytics and Google Ads — advertising measurement. One script serving both. It records the same page views and product events as above, and it reports back to Google when someone who arrived from one of our ads runs their first fetch, so we can tell which campaigns bring people who use the product. It sets cookies; see below.

What Google receives about you specifically. If you are signed in when a conversion is reported, we attach a SHA-256 hash of your email address so Google can match the conversion to the ad click that produced it (Google calls this “enhanced conversions”). We hash it in your browser: the address itself is never put on the page for Google’s script to read, and the hash cannot be reversed back into your address. Google also receives your IP address and the click identifier from the ad, as it does for any site running its tag.

We use none of this to make decisions about you individually. It exists to answer “is anyone using this, and did paying for that ad accomplish anything”.

What you can delete yourself, today, from the console or the API:

• Schedules - deleted outright, row removed.
• API keys - revoked, not deleted. The key stops working immediately, but the row (its name, masked prefix and hash) stays in the table.

Run history and usage events have no delete endpoint. To have them removed, email keronelau@gmail.com. We would rather tell you this than describe a retention schedule we have not built.

When you create an API key we generate it, return the plaintext value to you exactly once, and store only a SHA-256 hash of it alongside a masked prefix (for example ag_live_9f2…8c1d) so you can tell your keys apart. We cannot show you the key again, and we cannot recover it - if you lose it, revoke it and mint a new one.

Authenticating with a key means we hash the presented token and look for a matching, unrevoked row. We also stamp a last-used timestamp on the key each time it is used.

Paid plans are billed through Stripe, our payment processor. When you start a subscription, checkout happens on Stripe’s hosted page: your card number and billing details are entered directly into Stripe and handled by Stripe under its own terms. Your card number never reaches AgentGEO and is never stored in our database.

What we store is the minimum needed to know which plan you are on - your Stripe customer ID, your subscription ID and its status, the current period end, and whether it is set to cancel - in the workspace_settings table. Stripe tells us these through a signed webhook whenever your subscription changes; that webhook is also what moves your workspace between the unsubscribed state and a paid plan.

Stripe receives the email address and billing details you enter at checkout, and the usage we meter for overage - a per-customer count of delivered records, with no query or answer text attached. Managing your subscription (updating your card, changing plan, viewing invoices or cancelling) happens in Stripe’s billing portal, linked from the Billing page in your console.

Always on, and functional:

• Clerk session cookies. Set by Clerk to keep you signed in. These are required for the console to work. Clerk’s cookie practices apply.
• Theme preference. Your light/dark choice is stored in your browser’s local storage. It never leaves your browser.
• Console API key (self-hosted only). The console can hold an API key in local storage under agentgeo_api_key. On this hosted service that path is disabled: the console will not read or write that value, and it actively erases any key left there by an earlier version. It exists for people running AgentGEO locally, where the key is the only credential.
• Your cookie choice and the ad campaign you arrived from, both in local storage. The second one is kept so that if you later subscribe, we can tell which ad paid for it.

Advertising and analytics cookies: Google Analytics sets _ga and Google Ads sets _gcl_au, to recognise a return visit and to connect a signup back to an ad click. PostHog sets none — it uses local storage.

We do not run cross-site tracking, retargeting or advertising audiences built from your behaviour, and we do not load any social-network pixel.

If we add a sub-processor, this list changes and the “last updated” date at the top moves.

Email keronelau@gmail.com from the address on your account and tell us what you want:

• A copy of your data. You can pull most of it yourself through the API, with one catch worth knowing: GET /v1/runs lists your runs but strips the answers out of each one, so it is not a full export. GET /v1/runs/<id> returns a single run complete with its answer text, and GET /v1/usage returns your billing ledger. There is no bulk-export endpoint - for everything at once, email us.
• Deletion of your workspace data. We delete the rows keyed to your workspace ID by hand. We have not built an automated path for this, and we are not going to quote you an SLA we cannot enforce in code.
• Deletion of your account identity. That lives in Clerk; tell us and we will remove it there.

Depending on where you live, you may have statutory rights over your personal data - for example to access, correct, export, or erase it, or to object to its processing. Exercise them by emailing us; we will not ask you to justify the request. We have not completed a formal compliance certification of any kind, and this page makes no such claim.

Security issues, product questions and account support go to the same address: keronelau@gmail.com.

This policy describes the system as it exists on the date at the top of the page. When we change what we collect, where it goes, or how long we keep it, we update this page and move that date. If a change materially affects data we already hold about you, we will email the address on your account.

Privacy questions, access requests, deletion requests and complaints: keronelau@gmail.com.

AgentGEO is an independent project operated by an individual developer, with no registered company or business address. Email is the only contact channel.