Privacy policy

Trakis is run by its founder, based in Romania. For anything on this page — a question, a copy of your data, a deletion — write to hello@trakis.io. A person reads it.

When you sign in. With Google, we ask for your name, your email address and your profile picture, and nothing else — Google shows you exactly that list. We keep them to know which account is yours and to sign your reports.

When you use a password instead. We keep your email address and a salted, slow hash of the password (PBKDF2), never the password itself. To prove the address is yours we email you a link, sent through our email provider, Resend; we keep a fingerprint of that link, the time, and a hashed form of the sender’s IP address, only to limit how many links can be asked for. Unused links stop working after a day at most, and go with the account when it is deleted.

When you create an account. We note where you came from, as one short label: the page of this site you started on, the name of the website that linked you here (its address, like a search engine’s, never the page), or the name of the link you followed. Nothing is stored in your browser to do it. It is kept with your account, to learn which pages and places bring people, and goes when the account is deleted.

When you add a site. We crawl it: the addresses of its pages, their HTML, and what our rules found on them. That is the product. It stays with your account so the next audit can be compared with the last.

When you connect Search Console. That is a separate step, with its own Google consent, and only if you choose it. We store the token Google gives us and import the search analytics of the property you picked — queries, pages, clicks, impressions, positions; twelve weeks the first time, then the days since — so the audit can rank fixes by real traffic, show your positions week by week, and find the links worth adding. We read; we never write to Search Console.

When you share a report. A link to a client report is made only when you ask for one. We keep a fingerprint of it, never the link itself, with who made it, when, how many times it was opened and when last. We do not record who opened it. Anyone who has the link can read that report without an account, until you revoke it.

An audit is asked for from your account, and its results stay there. The short email that says it is ready names the first few changes since the audit before; the report itself is only in the account.

The public AI connector needs no account. An assistant that uses it sends us the code of a check or a word to look up, and gets the public explanation back; nothing about you or the conversation is stored in our database.

The account connector reads your own sites, and only after you sign in and allow it. We keep the name the assistant registered under, when you connected it and when it last read something; the access itself is stored only as a one-way fingerprint. It can read, never change, and you can disconnect it at any time in the settings, under Connected apps. The assistant’s own company handles what you then say to it, under its own privacy policy.

• The application runs on Cloudflare, close to wherever you are.
• The database is hosted by Neon in Frankfurt, Germany — inside the European Union.
• Emails — the link to set a password, a short note that an audit you asked for is ready, and monitoring alerts if you turn them on — go out through Resend.
• After an audit, the changes it found on your site’s public pages — their addresses, titles, descriptions and headings, before and after — are sent to Anthropic, whose Claude model writes the short explanation shown beside them. Nothing about your account goes with them, and Anthropic does not train its models on what is sent through its API.
• To measure speed, the addresses of a few of your site’s public pages are sent to Google PageSpeed Insights, which loads them the way a visitor would.

Those are the services that handle what we hold, and there are no others. We do not sell, rent or share it with anyone else, and we do not use it for advertising.

Two at most. The one that keeps you signed in, set when you sign in. And, only if you pick day or night in the settings, one that remembers which — the word “day” or “night”, nothing else, on this browser only. No advertising and no third-party tracking, on any page. Both are needed for what you asked for, so there is nothing to accept or refuse, and no banner.

Visits are counted with Cloudflare Web Analytics, from Cloudflare — already our host. It sets no cookie and keeps nothing that identifies you: it counts page views, where they came from and how fast the page loaded, and we see the totals, never a person.

• Your account and its sites: until you delete the account, or ask us to.
• Crawl history: as long as your plan shows it; older crawls are not displayed and are removed on request.
• Search Console data and tokens: until you disconnect the property or delete the account. You can also revoke our access at any time from your Google account permissions, which stops the imports on the spot.
• A shared link: it works until you revoke it. A revoked link stops at once; the record of who made it and how often it was opened stays with the account until the account is deleted.

You can ask for a copy of everything we hold about you, have it corrected, or have it deleted, at the address above. You can also delete the account yourself, in the settings — how, and what goes. Deletion removes the account, its sites, its crawls and its Search Console data together. If you think we have handled your data wrongly, you can also complain to the Romanian supervisory authority, ANSPDCP.

Trakis’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Search Console data is used only for what you see in your own account — your site’s audit and the order of its fixes — and for nothing else. In particular:

• It is never used for advertising, and never sold.
• It is not passed to anyone else, apart from the providers listed above that host and store it for us, or when the law requires it.
• Nobody at Trakis reads it, unless you ask us to (for instance to look into a problem with your report), for security, or when the law requires it.
• Access is read-only: we never change anything in your Search Console. You can disconnect a property from its site’s page, or revoke our access from your Google account permissions.

When this page changes, the date at the top changes with it. Anything that narrows your rights or widens what we collect is announced to signed-in accounts before it takes effect.