Privacy policy

Aeoly is an SEO tool that audits a website, writes articles for it and reports on how they perform. This policy covers the marketing site at aeoly.ai, the free scan, and the signed-in product.

Questions about this policy, or about data we hold on you, go to support@aeoly.ai.

Everything in this table is something the product stores. There is nothing collected for reasons we cannot name.

We do not ask for a password, because sign-in goes through Google and we never see one. We do not take payment details on this site.

When you connect Google Search Console, Google Analytics, Bing Webmaster Tools or WordPress, you grant us an access token. We store it encrypted and use it only to do the thing you connected it for: reading your search performance, or publishing an article you asked us to publish.

The Google grants are read-only. The product cannot change anything in your Search Console or Analytics account, because it never asks for permission to.

Disconnecting an integration deletes the token. You can also revoke our access from your own Google or Microsoft account at any time, which works whether or not you tell us.

Aeoly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you sign in with Google and connect your accounts, Aeoly can read:

• Your name, email address and profile picture, to create your account and sign you in.
• Google Search Console (read-only): the searches your site appears for, clicks, impressions, positions, and whether Google has indexed each page. This powers the Analytics, Indexing, Keywords and Pages to improve screens.
• Google Analytics (read-only): visits, engagement and conversions for your site, shown alongside the search numbers on the Analytics screen.
• Google Drive, only files Aeoly creates: when you choose to export a report to Google Sheets, Aeoly creates that one spreadsheet in your Drive. It cannot see or open any other file.

In line with the Limited Use requirements, data we receive from Google:

• is used only to provide and improve the features you can see in Aeoly;
• is shared with a third party only when that feature needs it, as described under Article generation and AI providers, or when the law requires it;
• is never sold, and never used for advertising, including retargeting;
• is never used to develop, improve or train general-purpose AI or machine-learning models;
• is not read by people, except with your permission, to investigate abuse or a security issue, or where the law requires it.

You can disconnect Google from Settings at any time, which deletes the stored access token, or remove Aeoly's access from your Google account at myaccount.google.com/permissions. To have the Google data we have already stored deleted, email support@aeoly.ai and we will remove it within 30 days.

Articles are drafted by large language models run by Anthropic, OpenAI and Google, and images by fal.ai. To do that, the brief and the research behind it are sent to whichever provider is generating that piece.

That means your briefs, drafts and keyword lists leave our systems for theirs. When you ask Aeoly to suggest an edit to one of your pages, the searches that page already appears for in Search Console, with its position and click numbers, are sent too, because the suggestion is written for those searches. Your account details and other customers' data are never included. If that transfer is a problem for your content, the honest answer is that this product cannot write without it.

The audit works by fetching pages from the site you point it at. It identifies itself as AeolyBot/0.2 (+https://aeoly.ai/bot), it reads pages and never writes to them, and it obeys robots.txt, including Crawl-delay.

It will crawl a site you do not own, because the free scan does not verify ownership before running. What it collects in that case is the public HTML of public pages, the same thing any search engine reads. The crawler page explains what it does and how to stop it.

We use a small number of service providers to run Aeoly: hosting, the database, email, the AI that writes and checks articles, search data, and publishing to the website you connect. Each receives only what it needs to do that job.

We do not sell data, and we do not share it for anyone else's marketing. Some of these providers process data outside the country you are in.

One cookie is needed for the product to work: the one that keeps you signed in. It holds a random token and nothing about you.

The marketing pages also load Google Analytics and Microsoft Clarity, which set their own cookies. Clarity records how a page is used, including scrolling, clicks and mouse movement, so that we can see where a page confuses people.

The sign-in and sign-up pages use Google reCAPTCHA to stop scripts using the email form to send sign-in links to people who did not ask for them. It sends Google information about your browser and how the page was used, and sets a cookie of its own. Google's Privacy Policy and Terms of Service apply to that check.

Google Analytics and Clarity load on every production page view, and there is currently no banner asking first. The cookie page sets out exactly what runs, and is honest about where that sits with consent law.

Depending on where you live you may have the right to see what we hold about you, correct it, delete it, take a copy elsewhere, or object to some of it. We will do any of these on request, and we will not charge for it or make it difficult.

The quickest route is support@aeoly.ai. If you ask us to delete an account we delete the projects, crawls, articles and tokens attached to it, not just the login.

If you think we have handled your data badly you can complain to a data protection authority in your country as well as to us.

This section is specific on purpose. The most sensitive things we hold are the OAuth tokens that grant read access to a customer’s Google Search Console and Google Analytics, and the search and analytics data we read with them. Each protection below names the mechanism rather than describing an intention.

In transit. Every connection to Aeoly is served over HTTPS with TLS. Plain HTTP is redirected, and the site sends an HTTP Strict Transport Security header so a browser that has visited once will refuse to connect over HTTP afterwards. Calls we make to Google’s APIs are HTTPS. No Google user data travels over an unencrypted connection at any point.

At rest. Google access and refresh tokens, and the credentials for every other integration, are encrypted before they are written to the database, using AES-256-GCM with a fresh initialisation vector for each value. GCM is authenticated, so a tampered value fails to decrypt rather than decrypting into something that then gets sent to Google. The encryption key is held in the server environment, never in the database and never in the source repository, so a database dump on its own does not yield a usable token. The database itself is also encrypted at rest by our hosting provider.

Access control. Signing in creates an opaque random session token, stored in a cookie marked httpOnly, Secure and SameSite=Lax: it cannot be read by any script on the page, is never sent over HTTP, and is not attached to cross-site requests. Every request for project data is checked against the signed-in user before anything is returned, so one customer cannot reach another customer’s Search Console or Analytics data. The database is not reachable from the public internet.

Minimising what is exposed. Both Google data scopes we request are the read-only ones, so the tokens we hold cannot modify a Search Console property or an Analytics account even if they were stolen. For Drive we request drive.file, which reaches only files Aeoly itself creates, rather than the broader scopes that would have been simpler to build against. We read only the properties a customer explicitly selects, and Google user data is never combined across customers.

Deletion. Disconnecting an integration deletes its stored token immediately. Deleting a project deletes the Search Console and Analytics data held against it. Deleting an account deletes the projects, crawls, articles and tokens attached to it, not merely the login. You can also revoke Aeoly’s access from your own Google Account at any time, which takes effect whether or not you tell us.

If something goes wrong. None of the above is a guarantee, and a policy that claimed otherwise would be worth less than this one. If we discover a breach affecting your data we will tell you what happened and what we know, promptly and in full, rather than the least we can get away with. Security concerns can be reported to support@aeoly.ai and we will not take action against anyone who reports one in good faith.

When this page changes materially we will update the date at the top and, for anything significant, tell account holders by email. Older versions are in the repository’s history, which is a more honest archive than a page claiming to be current.