We keep it simple.

What we collect

We collect your email address when you sign up, and the URLs of the websites you add to your account. We collect usage data (which pages you visit, which buttons you click) to see what helps and what gets in the way. We do not collect any data about individual visitors to your websites. If you connect Google Analytics or Search Console, we import totals from them, which the next section explains.

How we use it

We use your email to send you monitoring alerts and your weekly digest. We use your website URLs to run page audits and uptime checks. We don't use your data for advertising. We don't sell it or share it with third parties, except as necessary to operate the service (payment processing via Stripe, email delivery via a transactional email provider, and product analytics via Google Analytics if you allow it). If you connect an AI agent, it can read what you allowed it to read about your websites.

Google Analytics and Search Console

Connecting Google Analytics or Search Console is optional. When you connect one, you sign in with Google and give Bloomlight read-only access. We ask for two things: read-only access to your Analytics data (analytics.readonly) or to your Search Console data (webmasters.readonly), and your Google account's ID (openid), so we know which Google account each connection belongs to. We never see your Google password, and we cannot change anything in your Google accounts.

What we read. From Google Analytics: the names and IDs of the accounts, properties and web streams you can see, so you can choose the one that matches your website; the property's time zone; and daily totals of active users, sessions and views for the website and for each page path. From Search Console: the sites you can see and your permission level, and daily totals of clicks, impressions and average position for the website, each page, and the search queries that led people to it. These are counts. We don't receive anything about individual visitors.

What we do with it. We show it to you and to the people you've given access to your website, next to your audits. We use it to decide which pages to audit first, to rank problems by how many people they affect, to find busy pages you aren't monitoring yet, to point out pages with a low click-through rate or that are close to the first page of results, and to put traffic in your weekly email. If you connect an AI agent and allow it to read a website, the agent can read that website's traffic too.

What we don't do with it. We don't sell it, we don't use it for advertising, and we don't share it with anyone except as described above. We don't use it to train AI models. Nobody at Bloomlight reads it unless you ask us to, to look into a security problem or abuse, or when the law requires it.

How we keep it. The sign-in token Google gives us is encrypted in our database. The data we import is stored with your website.

Stopping and deleting. You can disconnect either service at any time from your website's settings. That revokes our access with Google and stops us importing anything new. You can also remove Bloomlight's access from your Google account settings. Data we have already imported stays with your website until you delete the website or your account, or ask us to delete it.

Bloomlight's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data retention

We keep your monitoring history for the retention period associated with your account. Additional data, such as Activities may be kept for as long as your account is active. If you cancel your account, we delete your data within 30 days. You can request immediate deletion by emailing us.

Cookies

We use a session cookie to keep you logged in, and one small cookie to remember your answer to the question below. Both are first-party and neither one follows you anywhere.

We also use Google Analytics to understand how people use Bloomlight. Its cookie is off until you say yes. Until then Google counts the page load but stores nothing in your browser, so it cannot tell whether you have been here before. Say yes and it stores a cookie, which is what lets us see that one person read three pages instead of three people reading one page each. Advertising, ad personalization, and remarketing stay switched off either way, whatever you choose.

Google Analytics never receives your email address or your name. Signed in, it receives a coarse profile of your account: your plan, your role, and rough size ranges such as "2 to 3 websites". Change your answer here whenever you like.

Your rights

You can delete your account at any time from your account settings. For anything else — data export, access requests, corrections, or questions — email us at hello@bloomlight.app.

Changes

If we make material changes to this policy, we'll email you before they take effect.

Bloomlight is operated by Bloomlight LLC. Phoenix, Arizona, USA.