In short
- Ordinary visits to websites that use OZMAICO are not stored.
- For people who arrive from an AI answer, we keep only the page and which assistant sent them, never their IP address.
- AI bots’ IP addresses are kept, because the address is the proof of who they are.
- We don’t sell data, show ads, or use tracking cookies.
If you have an account
We store your name, email address and a hash of your password (never the password itself), your websites and their domains, and how many hits your account recorded each month. A session cookie keeps you signed in; it is needed for the site to work. To stop people guessing passwords, a failed sign-in keeps the email and IP address for 15 minutes.
If you sign in with Google, Google tells us your name, your email address and an account id; we use them only to sign you in and never see your Google password.
You can change your details at any time, and delete your account under Settings. Deleting it removes your websites and all their data straight away.
Visitors to websites that use OZMAICO
The website owner decides to use OZMAICO; we process the data for them. Here is what is kept:
- AI bots (GPTBot, ClaudeBot and others): IP address, user-agent, page, time and the verdict. Kept up to 400 days.
- People who arrive from an AI assistant: the page, the time and the assistant’s name (for example “ChatGPT”). No IP address, no user-agent. Kept up to 400 days.
- Activity counts from the JavaScript tag: how many mouse moves, scrolls, clicks, keys and touches, and time on the page. No positions, nothing typed. They are tied to a visitor only by a daily, one-way hash of address and browser that can’t be turned back into either, and that changes every day. Kept 30 days.
- Ordinary visits: not stored, unless the website owner turns on “Save every visit”. Then the IP address, browser name and page are kept for 7 days, so the owner can spot AI agents that hide their name.
The Indexing tool
If you use a website’s Indexing tab, we store its IndexNow key, its sitemap address, and what was sent and how each search engine answered (kept 90 days). If you connect Google Search Console or Bing Webmaster Tools, we store the service-account key or API key you give us encrypted, use it only to submit and read your sitemaps, and delete it as soon as you disconnect. To read your sitemap and check your key file, our server fetches those files from your website’s public address.
The SEO tools
If you use them, we keep for your website: the searches and pages Google Search Console and Bing report for it, the keywords you add, the pages our crawler read from your site (address, title, headings and visible text — to find keywords and list problems), and your PageSpeed results. Each new load replaces the last; all of it is deleted with your website or account. Keyword ideas send your topic to Google’s suggestions, to Bing, and — for AI ideas — to OpenRouter with your page titles.
The free tools
The bot checker doesn’t store what you check. To stop abuse it counts checks per address for one minute, using a one-way hash, then forgets it.
Other services
Pages load the Inter and JetBrains Mono fonts from Google Fonts, so your browser connects to Google when you open them. To verify bots we download the companies’ public IP lists and look up reverse DNS for bot addresses. When you use the Indexing tool, the page addresses you choose are sent to IndexNow, Google or Bing, as you ask. We don’t send your data anywhere else.
Your rights
You can ask what we hold about you, have it corrected or deleted. Account holders can do most of this themselves under Settings. For anything else, including data a website collected about you, write to the email address on the About page.
Changes
If this policy changes, the date at the top changes too. Big changes will be announced in the app.