Privacy Policy

What we collect, why we use it, and how you can revoke access or remove your data.

Effective 25 August 2026

1. Who operates Searchange

Searchange is operated by Tetriz s.r.o. ("Tetriz", "we", "us", or "our"). Tetriz is the controller of the personal data described in this policy. Questions and privacy requests can be sent to hi@searchange.com.

2. What the service does

Searchange is a public leaderboard of websites ranked by aggregate organic clicks from Google Search Console. A website owner signs in with Google, reviews the verified properties available to them, and chooses which properties to publish. Their account lets them return to manage or permanently remove those listings and view a private, privacy-thresholded performance report and, if purchased, a page-level SEO opportunity report.

3. Data we process

Google authorization data

We store your current Google display name, verified Google email address, Google's stable account identifier, encrypted OAuth access and refresh tokens, their expiry time, and a random internal account identifier. These credentials authenticate your account and let the service refresh published metrics. We never receive or store your Google password and do not request your contacts, advertising data, or profile details beyond the display name you authorize for account identification.

Search Console data

We retrieve the URLs and permission levels of properties verified in your Search Console account. For properties you explicitly choose, we retrieve aggregate clicks, impressions, click-through rate, and average position for the latest stable 28-day reporting window and the immediately preceding comparison window. We retain daily aggregate snapshots to calculate privacy-thresholded market benchmarks. For published properties, we also temporarily request query-dimension rows to assign clicks and impressions to broad ranking-position buckets. Query strings are reduced in memory and are never stored. We retrieve aggregate device and country rows and store them privately by selected property to calculate cohort-level device and market conclusions. We do not request a user identity dimension. For authenticated websites, we retrieve current and previous 28-day page-level totals—page URL, clicks, impressions, CTR, and average position—to identify measurable opportunities. Only the latest page-level datasets are kept; Search Console query text is never included.

Private vertical benchmarks and deterministic reports

A peer is a reviewed, high-confidence core SaaS website in the same vertical, owned by a different account, with a fresh complete snapshot. A benchmark unlocks at 10 peers and is labelled established at 20. Traffic size only orders the nearest 40 when more qualify. Every displayed metric must meet its own contributor threshold. We compare aggregate percentages and position-bucket medians and never disclose peer identities, pages, queries, accounts, or individual peer rows.

The current free report is deterministic. It uses stored Search Console totals and privacy-thresholded anonymous aggregates to prioritize pages and create a structured copy for an AI assistant chosen by you. Searchange does not crawl public pages or send report data to an AI model in this phase. New AI-report purchases are paused; existing completed purchases and their refund records remain available.

Historical payments

New paid report checkout is paused. For earlier $9 USD one-time Checkout orders, Stripe processed applicable tax and any Promotion Code entered there. We store the report order, listed amount, aggregate discount, aggregate tax, amount collected, fulfillment type, currency, payment status, and Stripe Checkout Session, Payment Intent, and Promotion Code identifiers. We do not store the customer-facing Promotion Code text. Stripe receives the account email, customer name, billing address, and any optional business name or tax ID supplied in hosted Checkout. Stripe uses those details to process payment and generate a paid invoice and receipt, and retains its payment and invoice records according to its own legal and retention obligations. We do not store full card details or copy the Checkout billing and tax details into our database.

Published website information

For a selected property, we store and publicly display its domain, public description, favicon, reporting period, aggregate organic click count, and the percentage change in clicks between the current and previous reporting periods. The description is taken from public website metadata. Metrics not displayed on the leaderboard are used only to maintain and validate the service.

Visits and essential cookies

We use short-lived, secure cookies to protect the OAuth flow and a secure, HTTP-only account-session cookie for up to 30 days. Only a one-way hash of the random session token is stored in the database. We also set a first-party searchange_visitor cookie containing a random identifier for up to one year. Only a keyed one-way hash of that identifier is stored, so we can count unique visitors without storing the identifier in the database. We also use Plausible for aggregate website analytics. Our hosting and security providers may process ordinary request data such as IP address, user agent, timestamps, and requested URLs.

4. Why we process data

To authenticate a read-only Search Console connection with your consent.
To create your account and let you manage or remove your websites.
To show verified properties and let you choose what to publish.
To calculate, rank, and refresh aggregate organic click totals.
To publish anonymous market benchmarks only after the minimum cohort is reached.
To identify and prioritize page opportunities with deterministic first-party and aggregate signals.
To send one benchmark-readiness email when an eligible site first reaches 10 peers, unless you opt out.
To process, fulfill, support, and where applicable refund one-time report purchases.
To protect the OAuth flow, prevent abuse, and keep the service reliable.
To understand aggregate usage and improve Searchange.

Where applicable, our legal bases are your consent, performance of the service you request, and our legitimate interests in operating, securing, and improving the service. You may withdraw consent at any time as described below.

5. What becomes public

Only properties you select are published. The public leaderboard shows the website domain, public site description and favicon, reporting period, aggregate click count, and its current-versus-previous-period growth rate. We do not publish Google account names, email addresses, Google identities, OAuth credentials, Search Console queries, individual pages, or unselected properties. Anonymous CTR-by-position conclusions are calculated only from stored bucket totals. We also use those totals to publish a normalized, median impression distribution across broad ranking bands. Both conclusions are published only when at least 20 eligible websites contribute to the cohort. Device and country metrics are never published for an individual website; only cohort-level conclusions meeting the same threshold are shown.

6. Service providers and transfers

We use service providers only as needed to operate Searchange:

Google OAuth and Google Search Console API for authorization and metrics.
Vercel for application hosting, delivery, and operational logs.
Vercel AI Gateway and its selected model provider for private benchmark recommendations.
Stripe for hosted Checkout, payment processing, refunds, and payment records.
Supabase for the hosted database.
Plausible for aggregate website analytics.
Google's favicon service to display public website icons.

These providers may process data in countries outside your own. Where required, we rely on appropriate safeguards for international transfers and the providers' applicable data-protection terms.

7. Google API data

Searchange's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide and improve the user-facing leaderboard, account-management, and private benchmark functionality described here. We do not sell Google user data, use it for advertising, or allow humans to read it except when necessary for security, legal compliance, or support with your explicit permission.

8. Security and retention

OAuth tokens are encrypted before storage and are available only to server-side service code. We use access controls, secure cookies, and standard transport encryption. No online service can promise absolute security.

OAuth state cookies expire after approximately ten minutes, account sessions after up to 30 days, and the anonymous visitor cookie after up to one year. We keep your account name, email, and Google connection so you can sign in and publish again after removing a website. Site data, page metrics, purchased report snapshots, extracted page content, and recommendations remain only while that website is listed. Purchased reports remain accessible for their original Search Console snapshot and are not overwritten by a later snapshot. New paid report purchases are paused. Raw HTML is never retained. Stripe separately retains the payment records it is required to keep. We may retain limited records longer where required for security, dispute resolution, or law.

9. Revoke access or delete your data

You can revoke Searchange's Google access at any time from your Google Account connections. Revocation stops future Search Console refreshes but may not immediately remove an already published leaderboard entry.

Signed-in users can remove a website from their dashboard. Removal deletes the public listing, page metrics, purchased and unpaid report records, extracted page content, recommendations, and all stored metric, CTR-bucket, device, and country snapshots for that website. To delete your login, display name, verified email, sessions, and Google connection, email hi@searchange.com. We may verify account ownership and will process verified requests without undue delay, normally within 30 days.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, to object to certain processing, and to lodge a complaint with a data-protection authority. Contact us at hi@searchange.com to exercise these rights.

11. Children

Searchange is intended for website owners and professionals and is not directed to children under 16. We do not knowingly collect personal data from children.

12. Changes and contact

We may update this policy as the service or legal requirements change. Material updates will be posted here with a new effective date. Contact Tetriz s.r.o. at hi@searchange.com with questions or requests.