Privacy Policy

What we collect

• Your account - email address, a hashed password, and an optional display name. Passwords are stored only as a salted PBKDF2-HMAC-SHA512 hash and cannot be read back.
• If you sign in with Google: your Google account's stable identifier, the verified email address Google reports for it, your name (used as your display name when the account is first created), and the address of your Google profile picture, refreshed each time you sign in. We never receive your Google password.
• What you asked us to watch - the sites and URLs you enter, and which checks you enabled.
• What we observed - for each watched URL, the values of the checks you enabled: HTTP status, redirect chain, robots meta, X-Robots-Tag, canonical, title, meta description, heading, analytics tag presence, sitemap membership, DNS records, certificate expiry and similar. We record these values and the time they were observed.
• What Google says about them: if you connect Search Console, Google's index verdict for each watched URL, and the daily clicks, impressions, click through rate and average position for the site and for those URLs. The next section sets out what is read, what is never read, and what is deleted when you disconnect.
• Operational logs - request timing and error information, retained briefly for debugging.

Google Search Console data

Connecting Search Console is the main step of setting up a site, and it is still your choice: page monitoring runs and alerts the same without it. If you do connect it, you grant CrawlWarden read only access through Google's own consent screen, and the following applies.

• What we read: the Search Console properties your Google account can access and your permission level on each; for a property you link to a site, Google's daily clicks, impressions, click through rate and average position for that site and for the URLs you watch; and for each watched URL, Google's URL Inspection result, which includes its index status, the canonical Google selected, and when Google last crawled it. We also read the email address of the Google account you connect, to show you which account it is.
• What we never read or store: the search queries people used to find your site. We never request them. We cannot change anything in your Search Console, because the access is read only.
• How we use it: only to provide your own monitoring and alerts, which means detecting when Google's index status or numbers for your pages change, and showing you that alongside what CrawlWarden recorded changing on those pages. We do not use it for advertising, we do not sell it, we do not use it to train any model, and we do not share it with anyone except the providers listed below, as needed to deliver your alerts to you.
• Who can see it: you. Nobody at CrawlWarden reads your Search Console data unless you ask us to as part of a support request, it is necessary for security, or the law requires it. Our own support tools are built to make that the case rather than to rely on it: they show which check changed, on which page, and when, and withhold the values Google gave.
• How it is protected: the access Google grants is stored as a token encrypted with a key kept separately from our database, so a copy of the database alone cannot be used to read your Search Console.
• How long we keep it: a site's daily numbers are kept while its Search Console link exists, and numbers for individual pages for 120 days. When you disconnect a Google account or unlink a site, we revoke the access with Google and delete the stored daily numbers immediately. Alerts that were already raised keep the figures they recorded at the time, so their history does not change, until you delete the site or your account. You can also remove our access at any time from your Google account's security settings.

CrawlWarden's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we do not collect

We never request the search queries people used to find your site, so we never hold them. We do not store full copies of your pages beyond the retention window needed to compare consecutive observations. We do not use tracking cookies, we run no advertising scripts, we build no profile of you across sites or sessions, and we do not sell or share personal data with anyone for their own purposes.

Cookies, and everything else that runs in your browser

Reading this site stores nothing on your device: no cookie, nothing in local storage, nothing to dismiss before you can read a page. Switch the page between light and dark and we remember that one choice, on your own device, which is the only thing a visit writes. That is why there is no cookie banner here. A banner asks your consent for storage that, until you sign in, does not happen.

The complete list of what does run, and when:

• One cookie, after you sign in: cw_refresh, which keeps you signed in. It is HttpOnly, so no script can read it, and it is strictly necessary for the service you asked for. Your access token is held in memory only and dies with the tab.
• Local storage, for your own preferences: light or dark anywhere on the site, and, inside the signed in app, whether the sidebar is collapsed and which notices you have dismissed. Each one is written only when you make the choice, it stays on your device, and it is never sent anywhere.
• Cloudflare page speed analytics, which measures how long a page took to load. If you are reading this from the EU it is not sent to you at all: Cloudflare is set to leave the script out entirely for EU visitors, rather than send it and then discard what it reports. For everyone else it sets no cookie, stores nothing on your device, and does not follow you between visits or between sites.
• Paddle.js, on the pricing page only. It reads the list prices in your own currency so the cards do not quote dollars at a reader who does not pay in them, and it runs the checkout when you buy. Paddle loads its own Retain script alongside it, which is how Paddle handles failed renewals for existing subscribers. Neither sets a cookie when you are only looking at the page.
• Google's sign in script, only on a page with a sign in form, and only if you choose to use it.

Our fonts are served from this domain rather than from Google Fonts, so reading a page here does not report your IP address to Google.

A disclosure worth making plainly

If you are an agency, the pages you monitor may belong to your clients rather than to you. Therefore CrawlWarden stores metadata about websites that our customer does not own. We fetch only the specific URLs entered, we identify ourselves honestly in the user agent, and any site owner can have us stop by emailing support@crawlwarden.com or by disallowing CrawlWarden in robots.txt. See /bot.

Why we hold it

To provide the service: to compare today's observation against previous ones, to decide whether to alert you, and to answer "when did this start?". Billing data is held by our payment provider to meet legal and tax obligations.

How long we keep it

Observations are kept for the life of the account, because change history is the product. Detailed per-check records are rolled up into summaries as they age. When you delete your account, your account record, sites, URLs and observations are deleted, along with any Search Console data and the access you granted, which we revoke with Google.

Your rights

You can export your data or delete your account at any time from within the application. You may also email support@crawlwarden.com to request access, correction, export or erasure, and we will action it within 30 days.

Contact

support@crawlwarden.com