Privacy policy

Last updated 1 November 2026

Who we are

Console Clarity (consoleclarity.com) is run by Search Ventures Ltd (“we”, “us”). We are responsible for the personal data described here. The service is built and maintained for us by LincolnDigital.

What we access from Google

When you sign in, Google asks you to let Console Clarity see your Search Console data. That is the only permission we request (webmasters.readonly). It lets us read the properties you have access to and their performance, indexing and sitemap data. It doesn’t let us change anything in Search Console, and it doesn’t give us your name, email address or any other Google data.

Google Analytics is optional. If you choose to connect it on the Analytics page, we ask Google for read-only access to your Analytics properties (analytics.readonly). Your Analytics figures are fetched from Google each time you open that page and shown to you; they are not stored, cached or logged on our servers. Which Analytics property you pair with each Search Console site is remembered only in your browser. You can withdraw this access at any time at myaccount.google.com/permissions or with “Delete my data”.

How your Search Console data is handled

• Most reports are built in your browser. It fetches your figures directly from Google using a short-lived access key from our server, which expires within an hour. Those figures never pass through our servers. To keep pages quick, your browser keeps copies in this tab’s session storage for up to 15 minutes. They’re deleted when you sign out or close the tab.
• Algorithm update reports are worked out on our server. It fetches the figures they need from Google and keeps them in memory for up to 15 minutes. They’re never written to disk.
• Index coverage: browsers can’t read files from other websites, so when you check a sitemap our server downloads it from your site. It only fetches addresses on the property’s own domain, passes the list of pages to your browser and doesn’t keep it. Google’s verdict on each page goes straight from Google to your browser.
• Page check: when you check one of your pages, our server fetches that page’s HTML once to read its title, headings and visible text, and passes the text to your browser. The HTML and text are not stored, cached or logged. Matching the text against your searches happens in your browser (see the language model below).
• Files you add, such as an AI report export or a logo for a client report, are read in your browser and never uploaded to us.

What we store on our server

• Your Google sign-in tokens, encrypted, so you stay signed in. Signing out deletes them.
• The properties you choose to add, your annotations, any brand terms you set, and the rules for any page groups you create (the rules, not the figures).
• When you last visited, so we can show what changed since then, and the reason Google gave if it last refused to renew your access.
• Email alerts (coming soon, opt-in): if you switch on email alerts or the weekly digest, we store the email address you give us (only after you confirm it with a code we send you), the choices you make on the Email alerts page, and the last alert level we saw for each property you chose, so we can tell when it changes. No traffic figures are stored. While either is on, our server reads Search Console on your behalf for those properties a few times a day, with the same read-only access you signed in with, and keeps the figures in memory for up to 15 minutes to build the email. Every email carries an unsubscribe link that works without signing in; turning everything off stops the server reading Search Console for you, and deleting your data removes the address and the settings.

These are linked to a random ID kept in a cookie in your browser, not to your name or email address.

What your browser keeps

Besides the short-lived copies above, your browser’s local storage holds a few preferences on your own device: your light or dark theme, the name and logo you use on client reports and the sections you prefer, a count of the URL inspections you’ve run today for each property, so you don’t go over Google’s daily limit, whether you prefer to work by words or by meaning, and the Analytics property you paired with each site. The SEO tests you define (a name, a change date, page filters, a metric and a window) are also saved only in your browser; you can export them as a file or share one as a link, which carries the definition and no Search Console data. We never see any of these. You can clear them at any time in your browser settings.

Our use of Google user data

Console Clarity’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to show you your own Search Console reports and the analysis built on them.
• We don’t transfer it to anyone else, except where it’s needed for a feature you use, for security, to comply with the law, or as part of a sale or merger of the service, and then only with your consent first.
• We don’t use it for advertising, don’t sell it to data brokers or anyone else, don’t use it to decide anyone’s creditworthiness, and don’t use it to train AI models.
• No person reads it unless you ask us to for support, it’s needed to investigate a security problem or abuse, or the law requires it.

Other services our pages use

Our pages load fonts from Google Fonts, the chart library from jsDelivr and country flag images from Flagpedia (flagcdn.com). Like any website, those services see your IP address and browser details when a page loads, under their own privacy policies. A flag request carries only the two-letter country code, never which property you were looking at.

Some research tools look up public information about a website. When you run one, the domain or address you’re checking is sent to the service that tool relies on. Your Search Console data is never sent. The services are:

• Google: PageSpeed Insights, Chrome UX Report (Web Vitals history), Knowledge Graph Search (Brand Info), Public DNS, Transparency Report
• Google Autocomplete: Content gaps sends search queries your site ranks for, or ones you type, to get suggestions
• Bing Webmaster Tools: Bing backlinks, only if you enter your own Bing API key (see below)
• Internet Archive: Wayback Machine history
• Common Crawl: crawl history
• thum.io: page screenshots
• crt.sh and SSLMate Cert Spotter: certificate history
• who-dat and RDAP registries: domain registration
• feedsearch.dev: feed discovery
• Mozilla HTTP Observatory: security headers
• hstspreload.org: HSTS preload status
• W3C Markup Validator: HTML validation
• Green Web Foundation and Website Carbon: hosting and carbon checks
• AlienVault OTX, Shodan InternetDB and NIST NVD: threat intelligence
• DuckDuckGo: brand information
• IndexNow: only when you choose to submit URLs

Some of these services are based outside the UK, such as Google and Microsoft in the United States.

The Bing backlinks page needs your own Bing Webmaster Tools API key. It stays in your browser tab for the session and is passed to Bing with each request through our server, which doesn’t keep it. Closing the tab or signing out forgets it.

If you choose to work by meaning (on Topics, Content gaps, Keywords, Opportunities or Page check), your browser downloads a small language model (all-MiniLM-L6-v2) from Hugging Face, and the library that runs it from jsDelivr. The model then runs on your own device: your search queries and page text are not sent to us, Hugging Face or anyone else. Your browser keeps the model so it isn’t downloaded again.

On the Client report page you can ask Chrome’s built-in AI model (Gemini Nano, through Chrome’s Prompt API) to write the summary paragraph and the recommendations. It runs entirely on your own device: the figures it is given are the ones already shown in the report, and nothing is sent to us or to any other service. The button only appears in browsers that have the model; if Chrome needs to download it first, that download comes from Google, not from us. Anything it writes is for you to check and edit before you save the PDF.

Cookies

We use two cookies, both needed for the service to work: gsc_uid, a random ID that links your browser to your saved properties and settings (kept for a year), and ASP.NET_SessionId, which lasts until you close your browser. There are no analytics or advertising cookies.

Why we use your data

Under UK data protection law, we use your data to provide the service you’ve asked for, and, where needed, in our legitimate interest in keeping the service secure and preventing abuse.

Keeping it safe

Everything travels over encrypted HTTPS. Your Google sign-in tokens are encrypted on our server, and the access key your browser receives expires within an hour. Our access to your Search Console account is read-only.

How long we keep it

Your sign-in tokens are kept until you sign out, delete your data or Google withdraws them. Your properties, annotations and settings are kept so you can pick up where you left off, until you delete them.

Your choices and rights

• Sign out at any time to delete your Google sign-in tokens.
• Delete my data, on the Manage Properties page, deletes everything we hold about you straight away and asks Google to withdraw our access to your account.
• Remove our access from your Google account at any time at myaccount.google.com/permissions.
• Ask us for a copy of what we hold about you, or to correct it.

Under UK data protection law you can also complain to the Information Commissioner’s Office at ico.org.uk.

Children

Console Clarity is a tool for people who manage websites, and isn’t intended for anyone under 18.

Changes

If we change how we handle your data, we’ll update this page and the date at the top. We won’t start using your Google data in a new way without telling you and asking for your agreement first.