Privacy policy.

What I collect

Information you give me

• Newsletter signup — email address only. Stored by my email service provider, Brevo, which sends you a confirmation email first.
• Contact form — name, email, message body, and the topic radio button you selected. Sent to my inbox through Brevo's transactional email service by a Cloudflare Pages Function; it isn't stored in a database on this site.
• Course purchase (if applicable) — name, email, and payment method handled entirely by Stripe. I see name and email; I never see your card number.
• Booking a call — consultation calls are booked on Cal.com, which collects your name, email and the answers you give when booking. See Cal.com's privacy policy.

Information collected automatically

Standard web analytics: IP address (truncated by GA4), approximate location (country/region — not street address), browser type, device type, referring URL, pages visited, time spent, and outbound link clicks. This data is aggregated and anonymized.

How I use it

• Send the newsletter to people who asked for it.
• Reply to messages you send via the contact form.
• Decide which posts are working and which to rewrite or kill.
• Show ads on blog posts and earn affiliate commissions, which pay for the site.
• Improve site performance (page speed, broken links, etc.).
• Comply with the law if served with a valid subpoena or equivalent.

Blog posts carry Google AdSense ads (see below), so Google and its partners may use cookies to show and measure those ads, which can include ads based on your activity on other sites. Apart from that, I do not use your data for behavioral retargeting, audience selling, or any "data enrichment" service.

Cookies and tracking

The site uses the following:

• Google Tag Manager (GTM-WCQ8BCT) — a script loader that runs the analytics + tag stack below. Sets a _ga cookie chain.
• Google Analytics 4 — page views, sessions, events, outbound clicks. Cookie: _ga and _ga_*. Retention: 14 months.
• Cloudflare — performance / DDoS protection. Sets __cf_bm session cookie (30 min) per their bot-management.
• Google AdSense (blog posts only) — shows and measures the ads on posts. Google and its partners may set cookies such as __gads, __gpi, __eoi and IDE, and Google's consent messaging sets FCCDCF and FCNEC. Ads can be personalized from your activity on other sites. See how Google uses data from sites that use its services and control ads in Google's ad settings.
• Cloudflare Web Analytics — Cloudflare adds a small script that counts page views and load times from the page address, referrer and browser type. It sets no cookies.
• Cloudflare Turnstile — checks that the newsletter and contact forms are used by a person. When it runs, Cloudflare receives your IP address and technical details about your browser.
• Pagefind — on-site search runs locally in your browser; no tracking.

You can opt out of GA4 via the Google Analytics opt-out browser add-on, or by blocking the GTM script in your browser. The site works without it.

If you visit from the EU/EEA, the UK or Switzerland, analytics and advertising cookies stay off until you accept them in the cookie banner (Google Consent Mode); declining keeps them off. Everywhere else they are on by default, and you can block them in your browser settings.

Affiliate links

Some links on this site are affiliate links: links under /recommends/ and many Amazon links. If you buy through one, I may earn a commission at no cost to you. As an Amazon Associate I earn from qualifying purchases. When you click one, the destination knows you came from this site and may set its own cookies. For /recommends/ links I may count clicks per link per day, together with the browser type, referring page and country of the latest click; no IP address is kept.

Sharing

I don't sell, rent, or trade your data. I do share it with the following service providers — narrowly, only what each one needs to function:

• Brevo (newsletter, contact-form messages, course access and sign-in emails, SiteWide MCP summary emails)
• Cloudflare (hosting, DDoS, edge functions, form submissions)
• Google (Tag Manager, Analytics and AdSense)
• Stripe (payments, if you purchase)
• Cal.com (booking consultation calls)
• Affiliate partners (only that a visit came from this site)

If I ever sell the business or transfer it to a successor, your data moves with the business. You'd be notified before that happens.

SiteWide MCP

SiteWide MCP is a connector that lets your own AI assistant (such as Claude) read your marketing data. It only ever connects to the tools you connect yourself on your SiteWide account page, and only reads data to answer requests you make through your assistant. This section covers what that involves.

Your account

• Account details — your email address (to sign you in with a one-time link and send receipts), the sites you add, your plan, and a monthly count of how many requests you've made.
• Your connector token — stored only as a one-way hash, so it can't be read back, even by me. If you lose it, you get a new one.
• Apps you connect — an app you connect by signing in (Claude, Claude Code, Cursor) gets its own access to your account. Each one is listed on your account page, and you can revoke any of them there without affecting the others.
• Billing — handled entirely by Stripe. I see your name, email and subscription status, never your card number.

Tools you connect

Each tool is connected by you and can be removed at any time, from your account page or by asking me. Your credentials are encrypted (AES-256-GCM) before they're stored on Cloudflare, are never logged, and are only used to fetch the data you ask for:

Every connection below is read-only unless it says otherwise, and each one only reaches the accounts the login or key you connect can already see.

• Google (Search Console, AdSense, Analytics, Ads, Tag Manager, YouTube Analytics, Merchant Center and Business Profile) — through Google's own consent screen, or by adding SiteWide's service account as a viewer on your property. Details in the next section.
• Bing Webmaster Tools — through Microsoft's consent screen for Bing, or an API key you generate in Bing Webmaster Tools. Reads search performance and crawl statistics for the sites verified in your Bing account.
• Ahrefs — an API key you generate in your Ahrefs account.
• Semrush — an API key from your Semrush account. Reads domain, keyword and backlink reports, and each request spends your own Semrush API units.
• WordPress — an Application Password you create or approve in your own WordPress admin. By default it's only used to read your posts and pages. It makes changes only on sites you've explicitly switched to writable, only after showing you the before-and-after, and only within what that WordPress user's role allows: SEO fields (titles, descriptions, canonicals, schema type, image alt text), new drafts, edits to a post's body and internal links, post titles, slugs, excerpts, categories, tags and featured images, publishing or scheduling as a separate confirmed step, and images you ask it to upload from a link (it downloads that image to pass it to WordPress, and keeps only a fingerprint of it). Before each change it keeps the previous version, including the previous text of an edited post, for 180 days so the change can be undone; it never deletes or trashes anything on your site. Revoke it in WordPress at any time.
• Microsoft Advertising — through Microsoft's own consent screen. Reads the ad accounts your Microsoft login can see and their spend, clicks, conversions, campaigns and search terms. Stored: the access grant, your Microsoft Advertising user email, and the names of the ad accounts found when you connected. It never changes a campaign or a bid.
• LinkedIn Ads — through LinkedIn's own consent screen, with read-only ad and reporting permissions. Reads the ad accounts your LinkedIn login has a role on and their spend, clicks, conversions, leads and campaigns.
• Mailchimp — through Mailchimp's own consent screen. Reads campaign reports (sends, opens, clicks, bounces, unsubscribes, and store revenue if a store is connected) and audience size and growth. Stored: the access token, your account's data center and its name. It never reads individual subscribers' details and never sends anything.
• Public data — PageSpeed Insights, the Chrome UX Report, the Internet Archive, and SiteWide's own crawler, which reads the public pages of sites on your account. None of these need anything from you.

Disconnect any of them from your account page at any time. Where the provider lets SiteWide revoke the grant (Google, WordPress), disconnecting does that too; where it doesn't (Bing, Microsoft Advertising, LinkedIn, Mailchimp), SiteWide deletes its copy and the account page tells you where to remove the app on the provider's side.

You also choose which of your sites SiteWide may access, with an on/off switch per site on your account page. Switch any site off at any time and every SiteWide tool stops reading it.

Data fetched from these tools isn't stored: it goes straight back to your assistant (the Search Console summary on your account page, described below, is the one short-lived exception). It's never sold, never used for advertising, and never used to train AI models. How your assistant handles it after that is governed by that assistant's own privacy policy.

Your account page summary and summary emails

Once Search Console is connected, your account page shows a summary of each site you've switched on: clicks, impressions, average position and their change over the last 28 days, and the top few searches and pages. It's fetched with your own Google grant when you open the page.

If you switch it on from your account page, SiteWide also emails you the same kind of summary for up to three of your sites, weekly, every two weeks or every four weeks, as you choose. It's off unless you turn it on. Turn it off from the account page or with the link in any of the emails. The emails are sent through Brevo.

The emails' "Ask Claude" and "Ask ChatGPT" buttons open a new chat with a suggested question already typed in. That question contains only your site's name, never any of your Google data: your assistant fetches the numbers through SiteWide MCP, and only if you've connected SiteWide MCP to it.

If you haven't connected Search Console, SiteWide MCP may also send you up to three setup reminders. They contain no Google data.

Your Google data

If you connect your Google account, here's exactly what that gives SiteWide MCP access to and what happens to it.

What it can access

Only the Google products you connect, each with its own permission on Google's consent screen. You can untick any of them there:

• AdSense (adsense.readonly) — your AdSense earnings reports.
• Google Ads (adwords) — the list of Google Ads accounts your login can access (ID, name, currency, and whether it's a manager or test account), and campaign, keyword and search-term performance for the accounts you choose. Google only offers this one permission, which would also allow edits; SiteWide MCP only reads Google Ads data and never creates, changes or pauses anything.
• Google Analytics (analytics.readonly) — the list of your Analytics accounts, properties and web data streams (so a property can be matched to your site), and traffic reports for the properties you connect, including realtime visitors.
• Search Console (webmasters.readonly) — the list of your Search Console properties and your permission level on each (so SiteWide can confirm you control a site before connecting it), search performance reports, sitemaps, and URL inspection results.
• Tag Manager (tagmanager.readonly) — your containers and the tags, triggers and variables in their published versions.
• Business Profile (business.manage) — your locations, their performance (calls, direction requests, website clicks, views) and reviews. Google only offers this one permission, which would also allow edits; SiteWide MCP only reads and never replies to a review or changes a listing.
• YouTube Analytics (yt-analytics.readonly) — your channel's views, watch time, subscribers and traffic sources.
• Merchant Center (content) — your products' approval status and their clicks and impressions on Google. Google only offers this one permission, which would also allow edits; SiteWide MCP only reads and never changes a product or a feed.
• Your Google account's email address, so the account page can show which Google account is connected.

How it's used

Google data is used only to provide the features you use: to answer the requests you make through the connector (your AI assistant asks for a report, SiteWide MCP fetches it from Google and returns it to that assistant), to show your Search Console summary on your account page, and, if you switch them on, to send you summary emails. Nothing else. This applies to the raw data and to anything aggregated, anonymized or derived from it. Specifically, Google user data is never:

• sold, rented or shared with anyone other than the AI assistant you connected and the service providers listed below;
• transferred to data brokers, advertisers or information resellers;
• used for advertising, including retargeting or building advertising profiles;
• used to develop, improve or train AI or machine-learning models;
• read by a person, unless you ask me to for support, it's needed for security, or the law requires it.

SiteWide MCP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who it's shared with

• The AI assistant you connect (for example Claude, Claude Code or Cursor) — it receives the reports it asks for. What it does with them is governed by its own privacy policy.
• Brevo — delivers the summary emails, if you switch them on. Each email contains your Search Console summary for the sites it covers. Brevo acts as a service provider and doesn't use the data for its own purposes.
• Cloudflare — SiteWide MCP runs on Cloudflare's network and stores your encrypted grant in Cloudflare's storage. Cloudflare acts as a service provider and doesn't use the data for its own purposes.

Nobody else receives Google user data.

How it's protected

• All traffic to Google, to SiteWide MCP and to your assistant is encrypted in transit (HTTPS).
• Your Google grant is encrypted (AES-256-GCM) before it's written to storage, and it's never logged.
• A Google login can only be connected from your signed-in SiteWide account page, and its data is only ever fetched for requests made with your own connector.

What's stored, and for how long

The reports themselves aren't stored: they're fetched when your assistant asks and passed straight back to it. Summary emails are put together when they're sent and aren't kept by SiteWide MCP. SiteWide MCP keeps only:

• The access grant (an encrypted refresh token), the Google account's email address, the list of permissions you granted, and when you connected. Kept until you disconnect.
• The IDs you link to each site: a GA4 property ID, a Search Console property and a Google Ads customer ID. These are part of your site settings and are kept until you delete your account.
• The list of Google Ads accounts your login can access, cached for up to 5 minutes so a request doesn't have to look it up again.
• Short-lived access tokens Google issues from the grant (valid for about an hour), held in memory only, never written to storage.
• Your account page's Search Console summary for each site, cached for up to 6 hours so reloading the page doesn't ask Google again, then deleted automatically.
• Your summary-email settings (on or off, how often, the address it goes to) are kept until you turn the emails off or delete your account; the date the last one was sent is deleted automatically after 60 days.

Deleting it

• Disconnect from your SiteWide account page: revokes the grant with Google and deletes the grant, email and permission list immediately.
• Delete your account from the same page: deletes everything above, including the IDs linked to your sites.
• Remove SiteWide in your Google security settings: the grant stops working at once. SiteWide keeps the now-unusable encrypted grant and the email so your account page can tell you to reconnect, until you press Disconnect or delete your account.
• Ask me through the contact form, and I'll delete it within 30 days.

YouTube

SiteWide MCP's YouTube Analytics features use YouTube API Services. By connecting YouTube Analytics you agree to the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy. Everything above applies to YouTube data too: SiteWide MCP reads your channel's analytics only to answer your requests and doesn't store them. You can revoke SiteWide MCP's access to your YouTube data at any time from your SiteWide account page or from your Google security settings. Questions about how your data is handled can go to me through the contact form.

Your rights

Regardless of where you live:

• Access — request a copy of any data I hold about you.
• Correction — fix anything that's wrong.
• Deletion — remove it entirely. Mailing-list unsubscribe is one click.
• Portability — get a machine-readable export.
• Opt-out — turn off analytics or marketing emails any time.

EU/UK/EEA residents have additional rights under GDPR. California residents have additional rights under CCPA/CPRA. Either way, the request mechanism is the same: send a note via the contact form and I'll process it within 30 days.

Data retention

• Newsletter list — kept until you unsubscribe, then deleted within 60 days.
• Contact-form messages — kept for 24 months in case the conversation resumes, then deleted.
• Analytics — 14 months, then anonymized further.

International transfers

The site is hosted on Cloudflare's global network and data may pass through servers in the US, EU, or elsewhere. Where required (GDPR), my providers use standard contractual clauses or equivalent transfer mechanisms.

Children's privacy

This site isn't directed at anyone under 13. I don't knowingly collect data from children under 13. If you believe I have, contact me and I'll delete it.

Changes

I'll update this page whenever the data practices materially change, and bump the "Last updated" date at the top. For email-list members, I'll send a notice if anything changes that affects you directly.

Contact

Questions, requests, complaints? Use the contact form and I'll get back within 48 hours.