Legal

Privacy Policy

Last updated: 2026-05-27

This Privacy Policy describes how ByTheIndex ("BTI," "we," "our," or "us") collects, uses, protects, and shares information when you visit bytheindex.com, create an account, or use the BTI platform (collectively, the "Service"). This policy applies to all users of the Service, including operators who connect Google Search Console, Google Analytics 4, and Google Ads data sources to their sites.

We've written this policy to be clear and specific about what we actually do with your data, not to use legal boilerplate. If anything is unclear, contact us at hello@bytheindex.com.

1. Information we collect

1.1 Account information

When you create a BTI account, we collect:

1.2 Site connection data

When you connect a website to BTI, we collect:

1.3 Data we receive from Google services on your behalf

With your explicit OAuth authorization for each site, we receive data from Google APIs on your behalf. This data describes the search and analytics performance of your websites — we do not receive data about websites you do not own or have not connected.

Specifically, we receive:

1.4 Audit and structural data

We crawl public pages of your connected sites to read structural metadata — page titles, meta descriptions, canonical tags, JSON-LD, H1 elements, internal link structure. We do not read content behind authentication or paywalls. Our crawler identifies itself as ByTheIndex sitemap fetcher (+https://bytheindex.com) and respects robots.txt.

1.5 Outcome events

When you mark a recommendation as applied in BTI, we record the recommendation, the baseline metrics at that time, and follow-up snapshots of those metrics over the subsequent 7, 14, 30, 60, and 90 days. This allows the platform to learn whether the recommendation produced the expected improvement.

1.6 Information we do not collect

For clarity, we explicitly do not collect:

2. How we use information

We use the information we collect exclusively to:

3. Google API Services — Limited Use disclosure

BTI's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically:

You can revoke BTI's access to your Google services at any time from your Google Account permissions page at https://myaccount.google.com/permissions. Revoking access stops BTI from making future API calls on your behalf and triggers deletion of associated OAuth tokens within 30 days. Data previously retrieved and stored in your BTI account will remain until you also delete the connected site or your account.

4. Data sharing and third parties

We share data only as follows:

4.1 Infrastructure service providers

To operate the Service, we use cloud infrastructure providers who act as data processors on our behalf. These providers are contractually bound to handle data only as we direct:

4.2 AI inference

We use Anthropic (the Claude API) to generate natural-language descriptions of recommendations and to draft operator-facing content within the platform. Only the specific context needed for each generation is sent; Anthropic does not retain or train on the data we send per their API terms.

4.3 Anonymized cross-customer learnings

If you opt in (this is not the default for paid accounts; beta accounts are opted in with disclosure), anonymized outcome events from your account contribute to platform-wide learnings about which recommendations work for sites with similar growth models. The anonymization strips:

Preserved metadata includes the diagnosis category, the position/impression bucket the recommendation targeted, and the observed outcome class. The cross-customer learning layer activates only after a statistical floor is reached (currently 30+ events per category) to prevent any single account from being inferable from the aggregate.

4.4 What we do not do

We do not sell your personal information or data received from Google APIs. We do not share data with advertising networks. We do not allow third parties to use your data for their own purposes.

5. Data security

We employ industry-standard security measures including:

No method of transmission or storage is 100% secure. We work to protect your information but cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you without undue delay.

6. Data retention

7. Your rights and choices

You have the following rights with respect to your data:

To exercise any of these rights, contact us at hello@bytheindex.com. We will respond within 30 days.

8. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. If you believe a child has provided us with personal information, contact us at hello@bytheindex.com.

9. International data transfer

BTI is operated from the United States. If you access the Service from outside the U.S., your information may be transferred to, stored, and processed in the U.S. and other countries where our service providers operate. By using the Service, you consent to this transfer.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

11. Contact

Questions about this Privacy Policy or how we handle your data? Reach us at hello@bytheindex.com.

Last updated: 2026-05-27