Privacy policy

Search Explorer is a private SEO reporting tool operated by Verified Digital for its own team and clients. Accounts are created by an owner; there is no public sign-up. This page says what the service stores, why, for how long, and how to have it removed.

Who we are

The service at seo.verifieddigital.us is run by Verified Digital. Questions and requests about your data go to webadmin@verifieddigital.us.

What we store

• Account details. Your email address, a display name, your role (owner or standard), and sign-in records: a salted password hash (never the password itself), the public keys of any passkeys you register, when you last signed in, and the time-limited hashed tokens used for password resets. A password-reset request also stores the IP address it came from until that row is purged (used rows and rows expired for over a day are deleted daily), and repeated failed sign-ins are throttled per IP address and per email in server memory only, never on disk.
• Session cookie. A signed cookie that keeps you signed in for up to 7 days. It holds only your account id, a session version and an expiry. Short-lived cookies are also set during passkey ceremonies. No advertising or third-party tracking cookies are used.
• SEO data from a third-party SEO data provider. The domains, keywords and business listings you look up are sent to that provider, and the results it returns for them (backlinks, keyword metrics, search results, map rankings). Results are cached and shared across the accounts in this workspace, so a lookup one person paid for is free for the next. Every paid request is logged with the account that made it and its wholesale cost.
• Your sites. Domains you add under My Sites, their verification tokens (public by design: they are published in your DNS or on your site), starred Explorer targets, and local businesses you track (their public Google Business Profile details, ratings and reviews).
• Google Search Console data, once connected. When that feature is enabled you may connect a Search Console property to a site. Access is read-only and limited to the property you pick. We store a hash of your Google account id (never your Google email), the property name, and the Performance data synced from it (clicks, impressions, CTR and position by query, page, country and device). The refresh token Google issues is stored encrypted (AES-256-GCM) with a key that lives only in the server environment. Disconnecting a property deletes the token and every row synced from it immediately; you can also revoke the app at any time from your Google account permissions.
• Balances. For standard accounts, a ledger of the funds an owner allocated and the wholesale cost of each live request.

What we do not do

• We do not sell, rent or share personal data with anyone. Our third-party SEO data provider receives only the domains, keywords and locations you look up.
• We do not write to Google Search Console or any other Google service; the connection is read-only.
• We do not run analytics, advertising or fingerprinting scripts.

How long we keep it

• Cached SEO responses: 30 days, then deleted (a manual refresh replaces them earlier).
• Request logs: 30 days for cache hits, 180 days for live requests.
• Local rank-tracking runs and their results: 365 days.
• Password-reset tokens: 15 minutes; used or expired tokens are purged daily.
• Sites you archive: 30 days, then deleted together with their verification records; starred targets stay as bookmarks.
• Search Console data: while the site and its connection exist; deleted at once on disconnect or when the site is deleted.
• Account data: until the account is deleted by an owner, which removes everything attached to it.

Security

Passwords are hashed with scrypt; passkeys use WebAuthn; sessions are HMAC-signed and revoked on password change, role change or account disable. All traffic is over HTTPS. Data is stored in a managed Postgres database (Neon) and the application runs on Vercel.

Your rights

You can see your own account, balance and saved sites on the account page, change your password and passkeys yourself, disconnect Search Console per site, and archive sites. To export or delete your account and everything attached to it, or for any other request, email webadmin@verifieddigital.us; an owner will act on it.

Changes

If this policy changes, the date at the top changes with it. Material changes are announced to account holders by email.