Privacy Policy

They Will Know Me ("we", "us", or "our") operates the website theywillknow.me. This privacy policy explains how we handle personal data when you use our service.

Data controller: They Will Know Me
Contact: privacy@theywillknow.me

• To authenticate you and maintain your session
• To generate your SEO and GEO strategy report
• To process your subscription payments via Stripe
• To send you transactional emails (report ready, billing receipts)
• To improve the service through aggregate, anonymized analysis of the usage data described in Section 2.3. Google user data is not used for this purpose

We use Google user data only to provide the report and related user-facing features requested by you. We do not sell Google user data, use it for advertising, credit decisions, lending, data brokerage, or databases unrelated to your report, or disclose it to information resellers. We do not use Google user data to train or improve generalized AI or machine-learning models, and we do not opt in to Anthropic model training. We transfer Google user data only to Supabase, Hetzner, and Anthropic as described in Section 5 when this is necessary to provide the requested features, for security, or when required by law.

• Contract performance: Processing necessary to deliver the service you signed up for (account management, report generation).
• Legitimate interest: Security logging and fraud prevention.
• Consent: Access to your Google Analytics and Search Console data, and the use of analytics cookies (GA4, Google Tag Manager, PostHog). You can revoke analytics consent at any time via the cookie banner, and revoke Google data access from your Google account settings.

Hetzner processes Google user data in the application runtime, Supabase stores the OAuth credentials and report data, and Anthropic receives only the selected Google data required to generate your report. Anthropic does not receive your OAuth credentials, and we do not opt in to using API inputs or outputs for model training. Stripe, Resend, Google Analytics, and PostHog do not receive Google user data from your reports. Google Analytics and PostHog receive website and product usage events only after you accept analytics cookies.

• Access is limited to read-only Google OAuth scopes. They Will Know Me cannot modify your GA4 or Search Console data.
• Google API requests and transfers to Anthropic use encrypted HTTPS/TLS connections.
• OAuth credentials and report data are stored in a managed Supabase PostgreSQL database whose data and backups are encrypted at rest.
• OAuth credentials remain on the server and are never exposed in the browser or sent to Anthropic, Stripe, Resend, PostHog, or Google Analytics.
• Application access controls associate Google connections and reports with the authenticated user. Production credentials are restricted to the application runtime and authorized operations.
• Human access to Google user data is prohibited unless the user explicitly requests support involving specific data, access is necessary to investigate abuse or a security incident, or disclosure is required by law.

They Will Know Me's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google OAuth credentials: retained while your Google connection is active and deleted within 30 days after a verified deletion request or account deletion
• Report data, including selected GA4 and Search Console metrics: retained for up to 12 months after report creation, unless you request deletion sooner
• Server logs: 30 days
• Billing records: 7 years (legal requirement)
• Deletion requests: email privacy@theywillknow.me. After verifying the request, we delete the related OAuth credentials, selected Google metrics, and reports within 30 days, except data that we must retain for legal or security obligations
• When a retention period expires, the affected data is deleted or irreversibly anonymized

If you are in the European Economic Area, you have the following rights:

• Access: Request a copy of all data we hold about you
• Correction: Request correction of inaccurate data
• Erasure: Request deletion of your account and associated data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request that we pause processing of your data

To exercise any of these rights, email privacy@theywillknow.me. We will respond within 30 days.

We use strictly necessary session cookies for authentication. With your consent, we also use analytics cookies (Google Analytics 4, Google Tag Manager, and PostHog) to measure usage and improve the Service. No analytics cookie is set before you accept, and you can withdraw consent at any time via the cookie banner. For full details, see our Cookie Policy.

Some processors may process data outside the European Economic Area. Where required, these transfers are covered by an adequacy decision or Standard Contractual Clauses approved by the European Commission.

We may update this policy to reflect changes in the service or legal requirements. Significant changes will be notified by email at least 14 days in advance. The current version is always available at this URL.

For any privacy-related question or request, contact us at privacy@theywillknow.me.