Privacy Policy

1.1 Information You Provide

• Account Data: Email address, display name, and password (hashed) when you create an account.
• Google OAuth Data: If you sign in with Google, we receive your email, name, and profile picture from Google. We do not access your Google contacts, files, or other account data.
• Project Data: All information you submit about your projects — name, URL, description, founder name, screenshots, and other profile fields.
• Contact Information: Any messages or inquiries submitted through our contact form.
• Payment Data: When purchasing GQI Boost, payment is processed by Stripe. We store your Stripe customer ID and subscription status but never your credit card number or full payment details.

1.2 Information Collected Automatically

• Analytics Events: Page views, clicks, searches, and interactions with the platform to improve ranking and discovery features.
• Device & Browser Info: User-agent string, browser type, and device information for bot detection and platform optimization.
• AI Interaction Data: Queries made through Discovery AI are logged to improve search quality. These are anonymized and not linked to individual users unless you are signed in.

• Platform Operation: To create and manage your account, display your projects, and process subscriptions.
• AI Citability: To structure your project data for optimal visibility in AI search systems (Google AI Overviews, Perplexity, ChatGPT, Gemini).
• Ranking & Discovery: To calculate dynamic rankings, citability scores, and completeness metrics that help users find the best tools.
• Notifications: To send you relevant updates about your projects — ranking changes, completeness reminders, and platform news. You can manage notification preferences.
• Analytics: To understand usage patterns, improve the platform, and detect automated bot traffic.
• Communication: To respond to your inquiries and provide customer support.

We do not sell your personal information. We may share data in these limited circumstances:

• Public Project Profiles: Project information you submit is publicly visible by design — this is the core purpose of CitableHub. Your project data is structured as JSON-LD to be readable by AI systems and search engines.
• Service Providers: We use Stripe for payments, Google for authentication, and cloud infrastructure for hosting. These providers process data per their own privacy policies.
• AI Crawlers: We actively enable AI bots (GPTBot, Google-Extended, PerplexityBot, ClaudeBot) to index public project profiles. This is a feature, not a bug — it's how your project gets cited by AI systems.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation.

• Passwords are hashed using bcrypt (never stored in plaintext).
• All connections are encrypted via HTTPS/TLS.
• Authentication sessions use signed JWT tokens with secure HTTP-only cookies.
• Payment processing is handled entirely by Stripe (PCI-DSS compliant) — we never see your full card number.
• Database access is restricted and monitored.

• Account Data: Retained as long as your account is active. You may request deletion at any time.
• Project Data: Public project profiles remain visible as long as the project is listed. Owners can delete or delist projects from their dashboard.
• Analytics Data: Aggregated analytics are retained indefinitely. Individual event logs are retained for 12 months.
• Contact Form Submissions: Retained for 24 months for support purposes.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate data via your dashboard or by contacting us.
• Deletion: Request deletion of your account and associated personal data.
• Portability: Request your data in a machine-readable format.
• Opt-out: Unsubscribe from email notifications at any time.
• AI Indexing Control: You control what project data is public. Delisted or deleted projects are removed from AI indexing.

To exercise these rights, visit our contact page.

• Essential Cookies: Session authentication cookies (required for login functionality).
• Analytics: We use Google Analytics to understand platform usage. You can opt out using browser extensions or settings.
• No Third-Party Ad Tracking: We do not use advertising cookies or sell data to advertisers.

CitableHub is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

CitableHub operates globally. Your data may be processed in the United States or other countries where our infrastructure providers operate. By using CitableHub, you consent to the transfer of your data to these jurisdictions, which may have different data protection laws than your country of residence.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify registered users via email and update the "Last updated" date above. Continued use of CitableHub after changes constitutes acceptance of the revised policy.

For privacy-related questions or to exercise your data rights: