# Privacy > What netweft collects, which processors it sends data to, how long it keeps things, and what this marketing site does and does not run in your browser. Source: https://netweft.com/privacy Updated: 2026-10-20 This describes what netweft does with data in the product at `app.netweft.com` and on this marketing site. It is written to be checkable against how the software actually behaves. ## This website This site runs analytics only as far as you allow it. The first time you visit, a banner asks whether netweft may set analytics cookies. Until you answer, nothing is stored on your device and nothing you do is recorded; the analytics library only fetches its own settings. - **If you accept**, PostHog sets a cookie on `netweft.com` so it can tell one visit from the next, records which pages are viewed and clicked, and records session replays in which nothing you type is captured. The same answer applies on `app.netweft.com`. - **If you decline**, nothing is stored on your device. PostHog still counts the visit and the actions named below, from a one-way hash of your IP address and browser made with a salt it changes and deletes daily, so a declined visitor cannot be recognised from one day to the next. Either way, a few actions are recorded by name: which call to action was pressed and where it sat, a change of billing period on the pricing page, the plan a credit estimate fits, which section of a guide was reached, the guides filter, which free tool was used, run or copied from, and which code sample was copied. They never include what you typed, a URL you checked or a figure you entered. You can change your answer at any time with **Cookie settings** in the footer of this site, or in the account menu of the product. Analytics requests go to `relay.netweft.com`, a forwarder netweft runs, which passes them on to PostHog without your cookies. Fonts are self-hosted, and there is no tag manager and no advertising pixel. Requests reach Cloudflare, which hosts the site and keeps ordinary server logs. **The free tools** at `/tools`. Four of them run entirely in your browser and send nothing anywhere. The page checker and the redirect checker send the one URL you enter to netweft's API, which fetches it and answers with what it found; neither the URL nor the result is stored. To stop the tools being used as a free crawler, each run carries a Cloudflare Turnstile check, and netweft counts runs per visitor against a key made by hashing your IP address with a secret, so the count never holds the address itself. Each count is deleted shortly after its minute or day ends. ## What the product collects **Your account.** You sign in with Google, with GitHub, or with an email address and a password. - With Google or GitHub, we receive your name, email address and profile picture from that service, and there is no netweft password. - With an email address, you choose a password. It is stored only as a scrypt hash. When you set it, it is checked against the Have I Been Pwned list of breached passwords by sending the first five characters of a SHA-1 hash of it, never the password itself. We email a six-digit code, valid for five minutes, to confirm the address, and the same kind of code to reset a password. An email account that is never confirmed is deleted after an hour. Signing up, signing in and asking for a code each pass a Cloudflare Turnstile check, which tells people from bots. A signed-in session records the IP address and browser it was opened from; a session in the read-only demo records neither. **What you put in.** The domains, keywords, tags, notes and project briefs you create. This is the substance of a workspace and it belongs to you. **What netweft observes.** Rank snapshots, audit findings, keyword metrics and backlink data retrieved on your behalf, stored against your project. **Usage.** A ledger of every credit-spending operation: what ran, when, what it reserved and what it settled at. This is how billing works and it is visible to you in the dashboard. **Payments.** Handled by Polar. netweft does not receive or store card numbers. **Product analytics.** If you accept analytics cookies, the dashboard records how its screens are used, through PostHog. Session replays draw every word and every input on the screen as a blank, so your domains, keywords and figures are not recorded. PostHog knows you by an internal account id only — never your name or email address. Separately from the banner, the API records a short list of events against that same id: signing up, starting an audit, the actions in your workspace's audit log, buying credits, and errors. They store nothing on your device, and they exist so we can see how the product is used and fix what breaks. An error report carries the error's type and code, not its message. For the AI assistant, PostHog receives the model, the number of tokens, the cost and the time a reply took — never your prompts or the answers. ## Google Search Console and GA4 If you connect them, netweft requests **read-only** scopes at the moment you connect the integration — not at sign-in. It reads the properties you select per project. It never writes to either service. Access tokens are stored encrypted. You can disconnect at any time from the project's settings, and you can revoke netweft's access from your Google account independently of anything you do here. ## Who else sees data netweft sends data to these processors, and only for the purposes named: - **Google** — authentication, and the Search Console and GA4 data you connect. - **GitHub**: authentication, if you sign in with it. - **Cloudflare**: hosting for the site, the product and its database, and the Turnstile check at sign-in and on the free tools. - **Resend**: delivering the sign-in codes and invitations netweft emails. - **Have I Been Pwned**: the five-character hash prefix described above, when you set a password. - **DataForSEO** — keywords, domains and locations, in order to retrieve SEO data for them. - **OpenRouter** — prompts for the AI assistant and onboarding strategist, which include project context and figures read from your workspace. - **Polar** — subscription and payment processing. - **PostHog** (United States) — product analytics, session replay and error tracking, as described above. There is no advertising network in that list and no data broker. netweft does not sell data and does not share it for anyone else's marketing. ## How long things are kept Workspace data is kept while your workspace exists. Rank snapshots are kept as the history — that is what they are for, and deleting them retroactively would defeat the point of storing observations. Delete a project and its data goes with it. Delete your workspace and everything in it is removed. The usage ledger is retained for the period required for billing records. ## Your rights Write to to access, export or delete your data, or to ask a question about any of the above. If you are in a jurisdiction that grants you statutory data rights, they apply, and this address is where to exercise them. ## Security Sessions are signed, passwords are stored as scrypt hashes, and stored OAuth tokens are encrypted. Access to production data is limited to what operating the service requires. If you find a vulnerability, report it to with enough detail to reproduce it and a reasonable window before disclosure. ## Changes Material changes will be reflected here with a new date at the top of the page. The version history of this document is the version history of the file it is written in.