Your data, and what we do with it.

1. Who we are

Koval SEO Console (“Koval SEO”, “we”, “us”) is an online tool that audits websites for SEO problems and explains them in plain words. It is run by Oleh Koval, a sole proprietor registered in Ukraine. This policy explains what personal data we collect when you use the site at kovalseo.com and the app at app.kovalseo.com, and how we handle it. Questions? Email hello@kovalseo.com.

2. What we collect

Your account

When you create an account, we store your email address, your name if you give one, and your password in a hashed form — never in plain text. We use them to let you sign in and to write to you about the service.

If you sign in with Google instead, Google tells us your email address, your name and an identifier of your Google account. That is all we ask for: we never see your Google password and never get access to your mail, files or Search Console.

The sites and audits you create

When you add a website and audit it, we store its address, what our reader received from its public pages, the problems we found with the proof behind each one, and the history of your audits. We also keep the decisions you make, such as hiding a problem that doesn’t apply to you. This is the working data of the product — it is there so your action plan is waiting for you when you return.

The pages we read are public pages of the site being audited. If they show personal details, those details may appear in the stored copy; we use it only to produce and explain your report.

An audit without an account

You can audit a site without signing up. The result stays available for 24 hours after it is ready, and a cookie lets the same browser open it again or save it to a new account; a saved copy then belongs to that account. A short record of the check — the site’s domain and its counts — is kept longer, to see in total how the service is used. Before such an audit starts, a security check by Cloudflare confirms that a person, not a program, is asking. To limit how many audits one network can start, we keep a keyed fingerprint of the network your request came from — not your IP address in readable form — for about three days.

Emails we send you

We send emails that the service needs: confirming your address, resetting your password, and notices about your account. We don’t send marketing email.

Basic technical information

Like any web service, our servers and Cloudflare receive your IP address and browser type with every request. They are used to deliver the service, keep it secure and prevent abuse — never to build advertising or cross-site tracking profiles. A sign-in session keeps your browser type and how you signed in; it lasts at most 30 days, and signing out deletes it.

How the site and the app are used

On kovalseo.com, Cloudflare counts visits for us. In the app we use no outside analytics. We count, from our own records, what the service has done: sites checked, results saved, accounts created, audits started or refused and why, and sign-ins, by email or by Google. We keep these records for as long as the service needs them to work and to show in total how it is used; once you delete your account, they are no longer linked to you.

Payment information

None. The product is free right now, so we don’t ask for or store any payment or card details. If paid options are added, this policy will say who handles the payment before anything can be bought.

3. How we use your data

• To run the audits you ask for and show you the results.
• To keep your account and let you sign in.
• To keep the service secure and prevent abuse.
• To write to you about important changes, security notices or your account.
• To understand, in total numbers, how the product is used.

We do this because it is needed to run the service you asked for, because we have a legitimate interest in keeping it secure and in knowing in total how it is used, or because the law requires it. We do not use your data for anything else without telling you first.

4. What we never do

• We never change your website. The reader only reads public pages, the same way a search engine does. It cannot sign in to, edit or publish to any site it audits — this is built into how the tool works, not just a promise.
• We never sell or rent your data to anyone.
• We never run advertising or cross-site tracking on you.

5. Cookies and browser storage

The app sets only the cookies it needs to work: one that keeps you signed in (30 days), one that carries the address you typed on kovalseo.com to the app (15 minutes), and one that lets your browser reopen an audit made without an account or save it to a new account (24 hours). Signing in with Google adds two short cookies that protect that sign-in (10 and 15 minutes). Two more keep the language and the theme you chose for the app (30 days). The security check before an audit without an account is provided by Cloudflare and may set its own cookie for that purpose. Analytics cookies that an earlier version of the app set are removed on your next visit.

The app also keeps a copy of the public Rulebook in your browser, so it opens faster, and, for the open tab, a note it uses while the address you typed is carried over. kovalseo.com itself sets no cookies; Cloudflare, which delivers it, may set its own for security. For the open tab only, your browser keeps how you left the last pages — the page turn, the scrollbar, the footer — so the next page can carry on from them. Once you choose the Rulebook’s view, list or illustrations, your browser remembers it until you clear it. None of this is sent to us. We don’t use advertising or third-party tracking cookies.

The service does not change what it does in response to Do Not Track or Global Privacy Control: it sells no data and runs no advertising tracking, with or without them.

6. Who else handles your data

A few companies process data for us, only to run the service:

• Hosting Ukraine (Hosting Ukraine LLC) — the servers in Ukraine that the site and the app run on.
• Cloudflare — delivers the site and the app, protects them from attacks, runs the security check and counts visits to kovalseo.com.
• Resend — delivers the emails described above.
• Google — only if you choose to sign in with Google.

They may process data in other countries than yours. We don’t share your data with anyone else, unless the law requires it.

7. Where your data lives and who can see it

Your data is stored on servers we use to run the service. Access is limited to the people who need it to operate and support the service. We take reasonable technical and organisational measures to protect your data, though no online service can promise perfect security.

8. How long we keep it

We keep your account, your sites and your audits for as long as your account exists. If you delete your account, we delete it together with your sites, their audits and your sign-in sessions; records of what the service did remain only without anything that links them to you, apart from anything the law requires us to keep. The result of an audit made without an account stays available for 24 hours after it is ready. A sign-in session lasts at most 30 days, and signing out deletes it. Other security records are kept only for a short period.

9. Your choices

• See it — your data is in the app whenever you sign in.
• Take it with you — you can copy your whole action plan; for a copy of anything else, ask us.
• Delete it — you can delete your whole account at any time, in its settings.
• Ask us — email hello@kovalseo.com to see, correct or remove your personal data.

Depending on where you live, you may have more rights over your personal data under local law. We’ll honour them — just write to us. You can also complain to a data protection authority: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights, or another competent authority where you live.

10. Children

Koval SEO Console is a tool for website owners and isn’t intended for children under 16. We don’t knowingly collect data from children.

11. Changes to this policy

If we make meaningful changes, we’ll update this page and, where appropriate, let you know. The date at the top always shows when the policy took effect.

12. Contact

Questions about your privacy or this policy? Email hello@kovalseo.com.