Privacy notice.

This covers the SEO testing tools at williamharvey.uk/seo-testing. The rest of the site is covered by the site privacy page. No advertising, no selling data, and nothing used to contact you.

Who is responsible

William Harvey runs these tools and is responsible for the data described here. To ask anything, or to have your data deleted, use the contact form.

Testing without signing in

• The address you test and its report. The report (screenshots and what the page contains) can only be opened by you, in the same browser, for 24 hours. It isn’t saved to an account or shareable, and it’s then deleted.
• Your browser and the daily limit. A random identifier is stored in a cookie (st_visitor, one year): it lets only you open your reports, and counts the 3 tests a day. Your IP address is kept in a one-way scrambled (hashed) form for one day for the same limit.
• “Verify you are human”. Cloudflare Turnstile checks that you’re a person, not a bot. Cloudflare processes your IP address and browser signals for this, under the Cloudflare privacy policy.

Signing in with Google

• What we receive: when you choose “Sign in”, you go to Google’s sign-in page and Google sends us your email address (and confirms it’s verified). We don’t receive your password, and we don’t access your Google account, contacts, files or anything else.
• How it’s used: only to sign you in, keep your reports together so you can see, share and delete them, and apply the daily limit (12 tests). We don’t email you or add you to any list.
• Session cookie: st_session keeps you signed in for 30 days. Signing out removes it.
• Your reports are stored with your email address and kept for 30 days, then deleted automatically. You can delete any of them sooner. Anyone you give a report’s link to can open it.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Google Search Console (optional)

• What it allows: if you choose “Connect Search Console”, you give these tools read-only access to your Search Console data (Google’s webmasters.readonly permission). It can’t change anything in your account.
• What it’s used for: only to add Google’s data about the pages you test to your own reports: index status, last crawl and Google’s chosen canonical.
• How it’s kept: the access Google grants (a refresh token) is stored encrypted, never shown to anyone and never put in reports or exports. Your reports include the Search Console data for the page tested, for 30 days, like the rest of the report. It’s only shown to you: people you share a report’s link with don’t get it.
• Disconnecting: “Disconnect” on the SEO testing page deletes the stored access and revokes it with Google. You can also remove access at myaccount.google.com/permissions.
• Short-term copies: to stay within Google’s limits, Search Console results for a page are kept for up to a day in private storage, separately for each person. They’re only used after Google confirms you still have access to the property, and they’re deleted automatically.

Google data in reports

To add real-visitor and lab performance data, the address you test is sent to Google’s PageSpeed Insights and Chrome UX Report services, under Google’s privacy policy. Nothing about you is sent with it.

Testing a website

Tests run on our servers in Google Cloud (London, UK). They visit the address you enter from IP address 34.13.63.135, much like a browser, and store what they find in the report. Only enter addresses you’re happy to have tested and stored for the times above.

Analytics

As on the rest of the site, visits are measured with Google Analytics through Cloudflare Zaraz, only if you allow it in the cookie notice (see the site privacy page). These pages also record anonymous events such as “a test was started” or “a report was opened”, with the tested website and the results’ numbers. Never your email address.

Where data is held, and who processes it

• Google Cloud (London, UK region): the tools, test results and reports.
• “Notify me”: if you press it on a tool that’s coming soon, we keep your email address to tell you when that tool is ready, and delete it afterwards.
• Google Vertex AI: Server Error Intelligence sends a short technical summary of each problem it finds (addresses, status codes and browser messages, with cookies, credentials and personal data removed) to Google’s Gemini model, to write its explanation. Nothing about you is included.
• Cloudflare: delivers these pages, runs the human check and the analytics.
• Google: sign-in, Search Console (if you connect it), PageSpeed Insights and Chrome UX Report data, and analytics if you allow it.

Nothing is sold or shared for advertising.

Your rights

Under UK data protection law you can ask to see, correct or delete your data, or object to how it’s used. You can delete your reports yourself at any time; for anything else, use the contact form. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Changes

If this changes, the date at the top changes too.