Privacy

Last updated 12 November 2026

Two different groups of people

This page covers both: account holders, who sign up and add their own sites, and visitors to those sites, whose behaviour is measured anonymously.

What we store about visitors

When the Seonavo snippet runs on a page, it records the page path and title, the referring source, any campaign parameters in the URL, a broad device type (mobile, tablet or desktop), how far the visitor scrolled, whether they reached the bottom, how long they were actively engaged, how many times they clicked, any rage clicks, and any custom events the site owner has tagged.

To tell one visitor from another within a single day, Seonavo computes a one-way anonymous identifier from the site, the day, the IP address and the browser user-agent, combined with a secret key. The IP address itself is never written to disk, the identifier cannot be reversed, and it changes every day. The practical effect is that somebody who returns tomorrow is counted as a new visitor — that is deliberate, and it is what allows the service to work without cookies.

What we never store

• No cookies of any kind, for visitors or for tracking.
• No IP addresses.
• No names, email addresses, form contents or anything typed on the page.
• No screen recordings and no cross-site profiles.
• Nothing is sold, rented or handed to advertising networks.

What we store about account holders

Your name, username and email address, a hashed password that we cannot read, the sites you add, and timestamps for when you joined and last signed in. We use these to run your account and to email you about the service: activation, password resets, security notices and the weekly summary.

You can turn the weekly summary off at any time from My account, or from the unsubscribe link in the email itself.

How long data is kept

Visit data is kept for 90 days and then deleted automatically. Account data is kept while your account exists. Deleting a site removes that site's data; deleting your account removes your account, every site on it and all of their data, permanently and immediately.

Where the data lives

Everything runs on a single server operated for Seonavo, in a database that is not reachable from the web. There is no third-party analytics service in the chain and nothing is shared with one. The only outside service Seonavo talks to on your behalf is Google, and only if you connect Search Console (below).

The SEO scan

Site health only crawls sites that are registered in an account and verified as belonging to that account. It identifies itself as NabdBot, respects robots.txt, reads at most 40 pages and pauses between requests. It stores page titles, descriptions, headings and technical findings — never personal data.

The free one-page check

The free check reads the single public page whose address you enter, plus that site’s robots.txt, which it respects. It identifies itself as SeonavoCheck. We keep the name of the site that was checked, the address of the page, its score and the date, one row per site, and we may review that list. We do not keep who asked for the check: no IP address, no cookie and no account. To limit abuse, a hashed form of your IP address is kept for up to 30 minutes and then deleted. If you leave your email address under the result, we keep it with the site name so that we can write to you about that site; ask us at any time and we will delete it.

Google Search Console (optional)

If you choose to connect Google Search Console, you sign in with Google and grant Seonavo read-only access (the webmasters.readonly scope), plus your email address so you can see which Google account is connected. Seonavo then:

• reads the list of Search Console properties you can access, so you can pick the one that belongs to your site;
• once a day, downloads that property's search figures: clicks, impressions and average position for each page, and the searches that led to each page, for up to the last 90 days;
• shows them only to you, in your own dashboard, next to the visit data Seonavo collects on your site, and uses them to suggest what to improve.

Seonavo cannot change anything in your Search Console account. The access tokens are stored encrypted. The data is never sold, never shared with anyone, never used for advertising and never used to train AI models. Unlinking a site removes its downloaded search data. Disconnecting Google, or deleting your account, removes all of it and revokes Seonavo's access at Google straight away; you can also revoke it yourself at myaccount.google.com/permissions.

Seonavo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Excluding yourself

Open any page of your site once with ?nabd_ignore=1 on the end of the URL and that browser stops being counted. Use ?nabd_ignore=0 to undo it. Known bots and automation browsers are excluded automatically.

Your choices as an account holder

• View everything we hold about your sites from your dashboard at any time.
• Change your name, username, email address and password from My account.
• Delete a single site and its data, or your whole account and everything on it.

Your own obligations

Not using cookies removes the usual reason for a consent banner, but it does not by itself settle every privacy obligation that may apply where you or your visitors are. What applies to your site is yours to check.

Changes and contact

Seonavo is in beta and this page will change as the service does; the date at the top shows when it last did. For anything about your data, reply to any email we have sent you.