Privacy policy

uprank is built and run by Devino. This page explains what uprank collects when you use it, why, who else receives it, how long it is kept, and what you can ask us to do with it. Questions and requests go to [email protected].

We do not sell your data, show ads, or share data with anyone for advertising.

• Your account. Your email address, your name if you give one, and the workspace name you choose. If you sign up with a password we store only a salted scrypt hash of it, never the password itself.
• Sign in with Google or Apple. We ask only for your basic profile: Google's openid email profile scopes and Apple's name and email. We keep the provider's account identifier and your email address (only if the provider says it is verified), and we use your name once, to fill in your profile when the account is created. We do not store your profile photo, and we discard Google's and Apple's access and refresh tokens, so uprank cannot read anything else in your Google or Apple account.
• What you put into your workspace. Sites, brand profiles, campaigns, research sources and the claims drawn from them, articles and their versions, quality scores, link suggestions, and publishing records. When you ask uprank to learn your brand from your website, it also keeps the text of the pages it reads. Each pipeline run keeps its inputs and outputs so you can trace how an article was made.
• An audit log. Who did what in the workspace (for example, approving an article or issuing an agent token), with secrets removed. When an owner adds a member, the invited email address is recorded there.
• Integration credentials. A Strapi API token you connect is encrypted with AES-256-GCM before it is stored. Agent (MCP) tokens are shown to you once and stored only as a SHA-256 hash, along with their name, scopes, expiry and when they were last used.

We do not record your IP address or browser in our database. To slow down password guessing, the server briefly keeps your IP address (and, for a password sign-in, the email you typed) in memory for about a minute, and never writes it to disk.

uprank uses no advertising or third-party cookies. Everything below is set by uprank on its own domain.

We use PostHog to understand how uprank is used. It is a copy of PostHog that Devino runs on its own servers, not PostHog's cloud service. Your browser sends events to uprank's own address, which forwards them on; your cookies are never forwarded.

• The PostHog script records page views, when you leave a page, and clicks on links and buttons (including their visible text). It does not record what you type.
• PostHog also records about 1 in 10 sessions as a replay: page layout, clicks, scrolling, mouse movement, the browser console's log messages, and the timing and address of the page's network requests. Nothing you type is recorded (every input is masked), and text we mark as sensitive, such as names and email addresses, is masked. Other text on the page, such as site names and article text, is recorded as it appears. Replays under 2 seconds are discarded.
• The server records a few product events: signing up, signing in, creating a site or campaign, starting a pipeline run, issuing an agent token, and an agent's first call with that token.
• If you sign up, that event also carries how you first arrived: the campaign tags in the link you followed (utm_source, utm_medium and similar), the site that referred you (address without its query), and the address of the first page you opened, including its query string.
• Once you are signed in, events are tied to your user ID and workspace ID. We never send PostHog your email address or name. If your email address is on one of our own or test domains, sign-up and sign-in events also mark the account as internal so we can leave it out of reports; the address itself is not sent. Signing out resets the identifier on that browser.
• Like any web request, these events carry your IP address and browser user agent to our PostHog server.
• uprank does not currently act on the browser's Do Not Track setting. A content blocker that blocks the PostHog script stops these browser events; uprank works the same without them.

When a search engine or AI crawler (for example, a bot reading our llms.txt) fetches a public page, we record the page, the bot's name, its user agent and the referring page. We do not do this for people using a browser.

We use Sentry to find and fix errors. Like PostHog, it is a copy that Devino runs on its own servers, and your browser sends to uprank's own address, which forwards it on; your cookies and IP address are not forwarded.

• When JavaScript fails in your browser, Sentry receives the error message and stack trace, the page address and the address of the page you came from, your browser and device type, your browser language and time zone, and a short trail of what led up to it: your recent clicks (which element, not what you typed) and the page requests made. Console messages are not sent to Sentry.
• Sentry also records a replay of about 1 in 10 sessions, and of every session in which an error occurs. In these replays all text and all inputs are masked and images and other media are blocked, so a replay shows the shape of the page, not what is written on it or what you typed. The addresses of the pages you visit and of the requests the page makes are recorded with it.
• Sentry reports are not tied to your user ID, and uprank sends Sentry no user details.

• Google and Apple, only when you choose to sign in with them. They see that you are signing in to uprank.
• Your own CMS. When you push an article to Strapi, uprank sends it to the Strapi site you connected, using your token.
• AI and research providers. uprank can be set up to draft and score articles with OpenAI or Anthropic, research with Tavily, look up keyword data with DataForSEO, and read topic signals from YouTube and Reddit. When a provider is turned on, uprank sends it what that step needs: your brand profile, the topic and brief, evidence excerpts, article text for scoring, or a search query. It can also fetch the links cited in your articles to check that they work. As of the date above, this deployment runs all of these steps on built-in offline stand-ins, so none of your workspace content goes to these providers. We will update this page before that changes.
• Hosting. uprank runs on servers that Devino operates, and requests to it pass through Cloudflare's network.

uprank does not send email, so your address is not shared with an email provider. We will disclose data if the law requires it.

• Your account and workspace content stay until you ask us to delete them (see below).
• Sign-in sessions expire after 30 days or when you sign out. Expired and signed-out sessions are removed from the database the next time you sign in.
• The short-lived sign-in cookies expire after 10 minutes.
• Analytics events are kept until we delete them or you ask us to.
• PostHog session replays are kept for 5 years unless deleted earlier. Sentry error reports and replays are removed when that server's retention period ends, or earlier if you ask us to.

uprank does not yet have a self-serve button to export or delete your data, so email [email protected] from the address on your account and we will handle it within 30 days. You can ask us to:

• send you a copy of the data we hold about you;
• correct it;
• delete your account, the analytics and replays tied to your user ID and, if you are its only owner, your workspace and everything in it.

You can revoke agent tokens yourself on the MCP page at any time. To cut uprank off from your Google or Apple account, remove it under Google's third-party connections or in your Apple Account's Sign in with Apple settings.

uprank is served over HTTPS. Passwords are hashed, CMS tokens are encrypted, agent tokens are hashed, and session cookies are signed and unreadable by page scripts. Every workspace's data is kept separate from every other workspace's.

uprank's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google account only to sign you in, as described above.

uprank is a business tool and is not meant for anyone under 16.

When what uprank collects or shares changes, we update this page and the date at the top. See also the FAQ.