GEOKAMI
Legal

Privacy Policy

Last updated: September 23, 2026 · Effective immediately

1. Information We Collect

Account Information

When you create an account, we collect:

  • Your full name
  • Your email address
  • Your avatar URL (if you sign up via Google or GitHub)
  • Your password (hashed and encrypted via bcrypt)

Usage Data

We automatically collect and store:

  • Website URLs you submit for scanning
  • Scan results, scores, and recommendations
  • Points balance and transaction history
  • Subscription status and billing information
  • Login timestamps and activity streaks
  • Referral codes and referral relationships

Local Storage

Your browser's localStorage holds only what the page needs to keep working between visits, and none of it leaves your device:

  • The IDs of scans that are still running, so a page reload can resume tracking them
  • Which scan notifications you have already read
  • Your theme and layout preferences

Scanned URLs are not kept in localStorage. They are stored on our servers as part of your scan history, which you can see and delete from the dashboard.

2. How We Use Your Information

  • Provide and maintain the scanning service
  • Process scan requests and generate reports
  • Manage your points balance and subscription
  • Process payments through our payment processor (Stripe)
  • Send service-related notifications
  • Improve the Service and develop new features
  • Prevent fraud and abuse
  • Comply with legal obligations

3. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

  • Stripe: Payment processing. We share your email and billing details necessary to process transactions.
  • Google / GitHub: Authentication when you choose social login. We receive your name, email, and avatar from these providers.
  • Resend: Email delivery service for transactional emails.
  • PostHog: Product analytics. We send page views and, for signed-in users, your user id, name and email so we can see which features are used. Abuse signals (such as a refused signup) are sent with the email address and IP address salted and hashed, never in the clear.
  • Google Analytics: Traffic measurement for the public marketing pages.
  • Ahrefs and DomainScan: We query these public domain-intelligence APIs with the domain being scanned to retrieve its rating and registration date. Your own account details are not sent.
  • Legal requirements: We may disclose information if required by law or to protect the rights and safety of GEO Kami and its users.

4. Data Storage and Security

Your data is stored in a PostgreSQL database.

We implement industry-standard security measures including password hashing (bcrypt), input sanitization (DOMPurify), session management (7-day expiry), and HTTPS encryption for data in transit.

5. Third-Party Scanning

When you submit a URL for scanning, our crawler (User-Agent: AgentReadyScanner/2.0) makes HTTP requests to the target website to collect publicly available information such as robots.txt, meta tags, and protocol endpoints. We do not collect personal data from scanned websites. The scan results are associated with your account and stored in our database.

6. Google API Services (Search Console)

GEO Kami integrates with Google Search Console to provide SEO visibility reports. When you connect a Search Console account, we access your data using the https://www.googleapis.com/auth/webmasters.readonly scope.

What we access: search impressions, clicks, click-through rates, average positions, and query- and page-level performance data for the properties you have verified in Search Console.

How we use it: solely to display analytics and visibility reports inside your GEO Kami dashboard. Access is strictly read-only — we do not modify any of your Search Console settings.

How we store it: OAuth credentials are encrypted at rest. Report data is associated with your account and retained only while your account is active.

How we share it: we never sell Google user data, and we do not use it for advertising or to train generalized AI/ML models.

How to revoke it: you can disconnect Search Console at any time from your dashboard, which revokes our access token at Google and deletes the credentials we store. You can also revoke access directly at myaccount.google.com/permissions.

GEO Kami's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data Retention

We retain your account data, scan history, and points ledger for as long as your account is active. If you wish to have your data deleted, contact us at contact@geokami.com. We will process deletion requests within 30 days.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access a copy of your personal data
  • Request correction of inaccurate data
  • Request deletion of your personal data
  • Object to or restrict certain processing
  • Withdraw consent where processing is consent-based

To exercise these rights, contact contact@geokami.com.

9. Cookies

We use essential session cookies to keep you logged in. Sessions expire after 7 days of inactivity. We do not use tracking cookies or third-party advertising cookies.

10. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect personal information from children. If we learn we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email. The "Last updated" date at the top indicates when the policy was last revised.

12. Contact

For privacy-related questions, contact us at contact@geokami.com.

GEO KAMI - Experts in GEO Optimization & Solutions