Privacy Policy

1. Overview & Core Philosophy

RankForge ("we", "our", or "us") operates the Model Context Protocol (MCP) server SaaS platform located at rankforgeapp.pages.dev. We provide AI-native search engine optimization (SEO), technical website audits, competitor gap analyses, and generative answer engine optimization (AEO/GEO) capabilities directly inside AI coding IDEs (such as Cursor, Claude Code, Windsurf, Cline, Zed, and OpenAI Codex).

Our core engineering philosophy is built around data minimization and Zero-Storage Bring Your Own Key (BYOK) isolation. We believe your source code, private repository structures, and AI keys are strictly yours.

2. Information We Collect

We only collect the absolute minimum information required to operate your developer account and authenticate MCP requests:

• Account Authentication: When you register or sign in via Google, GitHub, or Email/Password, we receive your email address, display name, and an authentication UID via Google Firebase Authentication.
• BYOK Credentials (Encrypted): If you configure an Apify API token for automated headless crawling, it is immediately encrypted using AES-256-GCM and stored solely to dispatch actors on your behalf. Raw keys are never logged or exposed.
• Billing Metadata: Subscription status, Dodo Payments Customer ID, and billing intervals (Monthly/Annual) are stored to enforce tier quotas. We never store or process credit card numbers or CVVs; all payment transactions are handled directly by Dodo Payments as our merchant of record.
• Audit Usage Counts: Total monthly count of executed MCP tool calls and project domains to enforce plan quota limits (e.g. 10 audits/mo for Free, 100 for Pro).

3. Information We Never Collect or Store

• Source Code & Repositories: RankForge MCP tools only inspect public URLs and metadata you explicitly provide in tool parameters. We never read your local files, private Git repos, or proprietary business logic.
• Chatbot API Keys: Keys pasted into our BYOK AI SEO Analyst (Gemini, Claude, GPT) are kept in browser memory and discarded when you close your browser tab.
• Sensitive Financial Data: Full credit card details, billing addresses, and banking credentials are never visible to or handled by RankForge servers.

4. Third-Party Subprocessors

To deliver edge performance and secure payment processing, we partner with industry-leading infrastructure providers:

• Cloudflare Inc. (Cloudflare Pages & Cloudflare Workers Edge Network) — Serves our static assets, proxies API requests, and executes MCP protocol negotiation with sub-millisecond global latency.
• Google Cloud & Firebase (Authentication & Cloud Firestore) — Manages secure OAuth login and stores user profile records with encrypted credential blobs.
• Dodo Payments (Merchant of Record & Payment Gateway) — Processes global credit card payments, merchant tax compliance, invoices, and subscription renewals under PCI-DSS Level 1 compliance.
• Apify Inc. (Headless Crawler Actors) — Executes web scraping and SERP discovery using your private API key when triggered via MCP tools.

5. Data Security & Encryption Standards

We apply defense-in-depth security measures to protect every byte of data transmitted to RankForge:

• In-Transit Encryption: All communications between your IDE/browser and RankForge endpoints require TLS 1.3 encryption.
• At-Rest Encryption: All persistent credentials utilize AES-256-GCM authenticated encryption.
• HMAC Webhook Verification: Dodo Payments lifecycle webhooks are verified using SHA-256 HMAC cryptographic signatures before any subscription status is updated.
• Rate Limiting & Plan Guards: Atomic counters prevent quota abuse, API exhaustion, and unauthorized access.

6. Your Privacy Rights (GDPR & CCPA)

Regardless of your geographic location, we extend comprehensive privacy controls to all RankForge developers:

• Right to Access: You can view all data associated with your profile anytime directly in your Developer Dashboard.
• Right to Rectification: You can update or replace your Apify keys or credentials at any time.
• Right to Erasure (Right to be Forgotten): You may request full deletion of your account, audit records, and encrypted keys by emailing privacy@rankforge.app. Deletion is executed within 72 hours.
• Right to Data Portability: You can export your audit logs and configuration details in JSON-RPC format.

7. Cookies & Local Storage

RankForge does not employ invasive cross-site advertising cookies. We use minimal functional client-side storage:

• localStorage: Used strictly to preserve developer theme preferences and local session tokens.
• sessionStorage: Used to store temporary BYOK AI keys and checkout referral intents, which automatically purge upon tab closure.

8. Contact & Data Protection Officer

For inquiries regarding this Privacy Policy, data processing agreements (DPAs), or compliance verification, please contact our security team: