Security you can check
Growth Genie reads the places your site lives, so here is exactly what it can touch, what it never does, and how long it keeps what it collects.
Search Console
Read-only
We ask Google for read-only access to your search data. Nothing more.
Connections
Encrypted at rest
Access tokens are encrypted with AES-256-GCM, with rotating keys.
Sign-in
No passwords
A link or six-digit code by email, single use, expiring in 15 minutes.
Analytics
No raw IP addresses
Visitor analytics never store a raw IP address.
///Access
What we ask for, and what we never do
Every connection asks for the least it needs. You can disconnect any of them at any time.
Google Search Console
Read-only access to clicks, impressions and positions for the sites you connect.
We never change your Search Console settings.
GitHub
Today: read access to the contents of the repository you choose. When pull requests ship, write access to contents and pull requests in that repository only.
Never access to workflows or repository administration, and nothing is merged for you.
AI engines
We ask the engines your questions through their own APIs, or collect the real Google result.
We never sign in to an engine as you, and never scrape.
///Your data
How long we keep what we collect
- AI answers
- Answer results are kept for 400 days, and the full answer text for 90 days.
- Visitor analytics
- Kept for 90 days on Starter and 400 days on Growth and Scale.
- Removing a site
- A removed site is suspended for 7 days, so a mistake can be undone, and then its history is deleted.
- Where it runs
- Growth Genie runs on Cloudflare and Convex Cloud. Visitor analytics are kept in a separate Postgres database.
///Approvals
Nothing reaches your site without your yes
Every change Growth Genie drafts waits for you. Fixes will arrive as pull requests you review and merge yourself, and if a draft changes after you approved it, the approval no longer counts until you look again.
Questions about security? Write to us