Skip to main content
AutoIndexNow

Legal · updated 2026-10-29

Privacy policy

Short version: we store your account, the hosts you monitor, fingerprints of their pages and the log of what we sent to IndexNow. We never store page content, we do not sell or share data for advertising, and you can export or delete everything yourself.

Who we are

AutoIndexNow is operated by its owner, reachable at [email protected]. The service is hosted in the European Union.

What we store

  • Account: email address, name, a hashed password or the link to your Google account, and your sign-in sessions (they expire after 30 days).
  • Email: a log of the emails we sent you (type, subject and delivery status, not the body), your email preferences, and, if an address bounces or reports spam, that address on a suppression list.
  • Sites: hostnames, IndexNow keys and key file locations, sitemap URLs, your ignore rules, verification and monitoring state, deploy hooks and API keys (stored as hashes).
  • Pages: URLs, HTTP status codes, timestamps, the reason for each check, and a SHA-256 fingerprint of the normalized content with its algorithm version. No HTML, no rendered text.
  • Submissions: every request to an IndexNow endpoint with its response code, a short response excerpt and timing.
  • Billing: your Stripe customer id, plan, billing interval (monthly or annual) and subscription status, and for each payment the amount before tax, currency and Stripe invoice id. Card details and your billing address are not stored by us.
  • AI clients (MCP): the clients you connect, the permissions you approved, their access tokens, and a log of each tool call (tool name, outcome and the site or item it concerned, not what you typed).
  • Public tools: a salted hash of your IP address, the host you entered and the outcome, kept 30 days for abuse prevention.

Email

  • Service and security email (sign-in links, password resets, alerts about your sites, billing problems, required notices about the service) is part of using AutoIndexNow and is sent regardless of preferences.
  • Getting-started tips after sign-up can be turned off with the link in each email or on the account page.
  • Product news is only sent if you opt in, and every message has a one-click unsubscribe.
  • Receipts and invoices come from Link (Stripe), not from us.

Who processes data for us

  • Page rendering: pages on your verified sites are rendered in a headless browser we operate ourselves (Crawl4AI, on our own servers). The rendered page is discarded once its fingerprint is computed.
  • IndexNow: submissions (your host, key, key file location and the changed URLs) go to the IndexNow endpoint at api.indexnow.org, which shares them with participating search engines such as Bing.
  • Stripe and Link: Stripe runs checkout, subscriptions (monthly or annual) and the billing portal. Link (Sold through Link, LLC, a Stripe company) is the merchant of record for your purchase: it collects your name, billing address and payment details to take the payment and calculate tax, and sends receipts and invoices. Both act under their own privacy policies and may process data outside the EU.
  • Google, only if you choose to sign in with Google.
  • Email delivery: our email gateway and its delivery provider send our emails.
  • Analytics: self-hosted Umami counts visits to our public pages without cookies. Query strings and fragments are not recorded, and nothing is collected inside the signed-in app. Sign-up, onboarding and payment milestones are counted on our server without any identifier, and revenue as totals per plan. If session recording is switched on, it covers public pages only, with form fields masked.

We do not sell personal data or use it for advertising.

Support access

To help with a problem, an administrator can view your account as you see it for at most one hour. That access is logged, and it cannot change billing, delete the account or create credentials.

Every administrative action (support access, plan changes, revoked sessions and similar) is recorded in an audit log with the acting administrator's account id and email address, the account it concerned, and when. These entries are kept without a time limit, so each action stays attributable to the person who took it.

Retention

  • Check and submission history: your plan's history window (7 to 365 days; 7 days without an active plan).
  • Resolved alerts: 90 days. Public tool records: 30 days. Daily usage counters: 7 days. MCP tool-call log: up to 365 days.
  • Administrative audit entries: without a time limit. Records of one-time support links (account ids only): 30 days after the link expired.
  • Account data: until you delete the account.

Deleting your account removes your sites, URLs, history, keys, connections, usage counters and MCP log immediately and cancels any subscription. What stays: the delivery status of emails we sent (without your address or the subject), administrative audit entries about your account (without your address), records of one-time support links issued for your account (account ids only, until 30 days after the link expired), payment records needed for accounting (amount, plan and Stripe invoice id, without your name, email or account id), and a suppression entry if your address bounced or reported spam, so it gets nothing but sign-in and security emails from us, also if you sign up again with the same address. If you were one of our administrators, the audit entries for actions you took as an administrator keep your account id and email address after you delete your account.

Your rights

Export your data as JSON from the account page at any time, change your email preferences there, delete the account yourself, or email us for anything else (access, correction, objection, restriction). We respond within 30 days.

Cookies

One session cookie when you sign in. No advertising or third-party cookies.