Privacy Policy

Last Updated: October 2026

1. Information We Collect

INDEX MATRIX collects account information (email address, full name, encrypted password hash) and Google Search Console OAuth access/refresh tokens. All Google OAuth credentials are encrypted at rest using AES-256-GCM.

2. Use of Google User Data

Our use of Google API data strictly adheres to the Google API Services User Data Policy, including Limited Use requirements. We access Search Console data solely to verify property ownership, display URL inspection status, and submit sitemaps at the explicit request of the user. We never sell or share Google user data.

3. URL Auditing & Data Isolation

URLs submitted to INDEX MATRIX are associated strictly with your customer workspace. Data is isolated using multi-tenant database constraints. Public HTTP audit requests are performed with SSRF safeguards and never execute arbitrary client scripts.

4. Data Security

All communications occur over TLS 1.3 encryption. Passwords use salted bcrypt hashes. API keys are stored exclusively as SHA-256 digests.