Privacy Policy

IroPeak (iropeak.com) is an SEO dashboard for website owners. You add your websites, and IroPeak measures them and shows scores, reports and suggestions for each one. AEO and GEO measurement are planned and are not available yet.

This policy explains what IroPeak collects, how it is used and the choices you have. Questions are welcome at [email protected].

To sign up with an email address, you give IroPeak your email address and a password. IroPeak stores the email address and a bcrypt hash of the password, never the password itself.

If you continue with Google, IroPeak asks Google only for basic sign-in details (the openid, email and profile permissions). Google sends your email address, whether it is verified, your name and your profile picture. IroPeak keeps only the email address, and accepts it only when Google has verified it. If an account with that address exists, you are signed in to it; otherwise a new account is created with a random password that nobody knows.

IroPeak also keeps when your account was created, whether it is active or suspended, and a record of the measurements it starts that count toward the daily limits (their kind and time). While you are signed in, a session stored on our server links your browser to your account.

For each website you add, IroPeak stores its address and what you set up for it: its sitemap address, brand terms and keyword country, your keywords and keyword groups, competitors, link prospect statuses, disavow choices and completed actions.

To measure a site, IroPeak:

• visits its public pages from our server, identifying itself as IroPeak: the homepage (to recognise the platform and find the site's icon), robots.txt, the sitemap and the pages it checks for suggested links;
• asks Google PageSpeed Insights to test the homepage on mobile and desktop;
• asks DataForSEO to crawl up to 5,000 pages of the site, and keeps each page's address, status code, title and issues, and the broken links found;
• fetches from DataForSEO the search volume, difficulty, cost per click, competition and intent of the keywords you add or look up, the first-page keywords and most visited pages of the competitors you add, and public backlink data for your site and its competitors.

From these results IroPeak builds the site's scores, issues, weekly action list and history. The first PageSpeed test and crawl start when you add a site; after that, the site is crawled again about once a week, and you can start measurements yourself.

Connecting Google is optional. On a website's Connect page you can link Google Search Console, Google Analytics and Google Ads separately, each with the Google account you choose. Each connection asks Google for your Google account's email address and for access to that one service, which IroPeak only reads:

• Google Search Console (webmasters.readonly): the properties your Google account can see, of which only a property of the site's own domain can be chosen; the search performance of the chosen property (queries, pages, clicks, impressions, click-through rate and average position, by date, country and device); its sitemaps; and URL Inspection results that show how Google indexes the site's important pages.
• Google Analytics (analytics.readonly): your Analytics accounts and properties and their web data streams, used to find the property that measures the site; and summary reports of the chosen property: users, sessions, key events, landing pages and traffic channels. These are totals; IroPeak does not receive data about individual visitors.
• Google Ads (adwords): the Google Ads accounts your Google account can open, with their names; and reports of the chosen account: the cost, clicks and conversions of its Search campaigns and the search terms that led to conversions. Google offers Ads access only as one permission that would also allow changes; IroPeak only reads reports and never changes your campaigns or your account.

For each connection IroPeak stores the Google account's email address and account ID, the permissions you granted, and a refresh token that lets IroPeak read the data without asking you to sign in each time. The refresh token is encrypted before it is stored.

While a service is connected, IroPeak reads it when you open its reports and, in the background, to keep the site's figures current: daily summaries for the Sites page and regular URL Inspection checks. To keep pages fast, copies of Google's answers are reused for up to a day (15 minutes for figures that include today) and deleted after two days.

IroPeak uses the data described above only to provide IroPeak to you:

• to show you your own reports, scores and suggestions inside IroPeak;
• to run the measurements you start and the scheduled ones described above;
• to keep your account secure (signing in, protecting forms, limiting repeated sign-in and sign-up attempts) and to apply the daily limits on measurements;
• to answer you when you write to us.

We do not sell your data, we do not use it for advertising, and we do not use it to train AI models. Nobody at IroPeak reads your data, except with your permission when you ask for support, when it is needed for security (for example to investigate abuse), or when the law requires it.

IroPeak's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice:

• Data from Google APIs is used only to sign you in and to show you your own reports and suggestions in IroPeak.
• It is not sold, not used or transferred for advertising, and not used to train AI or machine-learning models.
• It is kept on IroPeak's server and shown only to your account. It is not sent to DataForSEO or any other data provider.
• Nobody reads it, except with your permission for support, for security, or when the law requires it.
• If we ever want to use Google data in a new way, we will update this policy and ask for your consent first.

You can disconnect any Google service at any time on the site's Connect page in IroPeak. Disconnecting deletes the saved connection at once, and when no other site in IroPeak uses that Google account, IroPeak also asks Google to revoke its access. You can also remove IroPeak's access yourself at myaccount.google.com/permissions.

IroPeak works with these providers, and each receives only what it needs:

• Google: PageSpeed Insights receives your site's homepage address; Search Console, Analytics and Google Ads answer the requests made with the connections you choose; Sign in with Google confirms who you are.
• DataForSEO: receives the domains of your sites and competitors, your sitemap address, the keywords you add or look up and the country you choose, and returns crawl, keyword, competitor and backlink data. It does not receive your email address or any data from Google.
• Cloudflare: the network in front of iropeak.com. It provides the secure HTTPS connection and protects the site from abuse, so all traffic to IroPeak passes through it.
• Amazon Web Services: runs the server and database that store IroPeak's data.
• Resend: delivers any email IroPeak sends you. It receives your email address and the message.

We may also share data when the law requires it.

IroPeak sets three cookies of its own:

• connect.sid: the session cookie. It keeps you signed in and carries a security token that protects forms. It is set when you use the sign-in, sign-up or dashboard pages and expires after seven days.
• theme: remembers whether you chose the light or dark theme, for a year.
• nav: remembers which sidebar groups you closed in the dashboard, for a year.

The dashboard also keeps the sidebar's scroll position in your browser's session storage, which is cleared when you close the tab. The public pages of iropeak.com remember your light or dark choice in your browser's local storage, which stays on your device. IroPeak uses no advertising or analytics cookies and no third-party trackers. Cloudflare may set its own strictly necessary security cookies when it checks traffic for abuse.

Your account and your sites' data are kept while your account exists.

• To delete a site, open its options on the Sites page and choose Delete Site. The site and everything stored for it, including its measurements, reports, lists, history and Google connections, are deleted at once.
• To delete your account, email [email protected] from your account's email address. We delete the account and all its data within 30 days. You can also remove IroPeak's access to your Google account at any time at myaccount.google.com/permissions.
• Some data expires on its own: copies of Google's answers after two days at most, URL Inspection results for pages no longer checked after two weeks, sessions after seven days, and the counts of sign-in and sign-up attempts, kept only in the server's memory, after an hour at most.
• Public backlink data about a domain is kept in a cache shared by all accounts. It is not linked to your account, and it is fetched again when it is needed and more than seven days old.
• Backup copies of the database are made every day and when IroPeak is updated, and each copy is deleted after 30 days.

• Connections to iropeak.com are encrypted with HTTPS.
• Passwords are stored only as bcrypt hashes.
• Google refresh tokens are encrypted with AES-256-GCM, using a key derived from a secret kept on the server.
• A site's data is shown only to the account that added it. Forms are protected against cross-site request forgery, and repeated sign-in attempts are limited.

No service can promise perfect security. If you find a security problem, please tell us at [email protected].

You decide which websites to add and which Google services to connect, and you can delete a site or disconnect a service at any time.

You can ask us for a copy of the data we hold about you, or ask us to correct or delete it, by writing to [email protected]. Depending on where you live, the law may give you further rights, such as the right to complain to a data protection authority.

IroPeak is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

When we change this policy, we publish the new version on this page with a new effective date. If a change affects how we use Google data, we ask for your consent before it applies.

For questions or requests about your privacy, write to [email protected].