Privacy policy

Data Lightmark receives

When you run a scan, Lightmark receives the URL you submit. The server requests that public URL and related discovery files, then processes the returned status codes, headers, HTML, and extracted diagnostic evidence. Do not submit URLs containing access tokens, private identifiers, or confidential query parameters.

Vercel hosts the application and may process ordinary request metadata such as IP address, user agent, requested path, and timestamp in infrastructure logs. Lightmark includes a PostHog page-view integration with automatic interaction capture and session recording disabled. Private project routes are excluded from these application analytics events.

Private accounts and projects

Accounts use a username, a salted password hash and a hashed recovery code; no email address is required. Session tokens are stored as hashes on the server and expire after seven days. Recovery rotates the code and revokes existing sessions. Authentication limits store hashed client identifiers rather than raw IP addresses. Records older than one day are cleaned up during subsequent authentication requests.

Project names, site origins, saved crawl reports and uploaded search or AI-answer evidence are stored in Neon and restricted to the signed-in account. Private project evidence is not added to the public leaderboard or public report endpoints. On the public SEO page, imports remain in the browser tab; uploading through Projects explicitly saves them. Imported evidence is not independently verified.

Private records remain until you delete them. When you enable monitoring, a scheduled worker fetches the public site and saves new reports and in-product alerts. Monitoring does not send email or personal messages. Deleting a project removes its saved scans and evidence. Account deletion, available in account settings with password confirmation, removes all private projects and sessions. Hosting/database backups and infrastructure logs follow the providers' retention policies. Public audits are separate and are not removed by deleting a private account.

Storage and use

Lightmark uses submitted URLs and fetched public evidence to produce the requested scorecards, findings, and Improve prompt. When database storage is configured, the submitted URL, score, generated report, and creation time are stored in a Neon-hosted PostgreSQL database so scan results can support report history and product operation.

Stored diagnoses have no automatic expiration in the current application. Lightmark does not sell submitted URLs or scan reports. A deletion request can be made through the contact page; include the exact public URL needed to locate the record without sending credentials or private data.

Browser storage and cookies

Lightmark can store a theme preference in your browser's local storage. Signing in sets a host-only, HTTP-only session cookie; production uses Secure and SameSite=Strict. The configured public-page analytics integration may use browser storage when it is allowed by the site security policy. Security and hosting infrastructure may also use technical request handling outside the application code.

Optional Google connection

When configured, you can grant read-only access to Search Console and Google Analytics. Lightmark stores encrypted access and refresh tokens and uses a short-lived, HTTP-only SameSite=Lax cookie to complete authorization. Measurements you explicitly fetch are saved privately to your project, including search queries, pages, traffic sources, configured key events, revenue and requested indexing evidence.

Disconnecting Google deletes Lightmark's stored tokens and cancels pending authorization. Saved measurements remain until you delete the project or account. Disconnecting here does not revoke the grant in your Google account; you can revoke it there separately. Google data is not added to public reports or used for advertising.

Performance and AI citation measurements

When you request performance measurements, Google PageSpeed or CrUX receives the public page URL or origin and device selection. Imported Lighthouse reports and fetched results are saved privately with their provenance.

When configured and explicitly requested, citation sampling sends your saved prompt, language and approximate country to OpenAI for web-search answers. The target and competitor domains are used locally for counting citations; they are not automatically added to your prompt. Do not include confidential information in prompts. Answers, citation URLs, provider identifiers, timestamps and usage metadata are stored privately. Requests use the provider's store=false option; this does not override its infrastructure or safety retention policies. Deleting the project or account removes Lightmark's saved prompt sets and samples, not provider logs. No sample is collected simply by opening a project.

Third parties and outbound requests

Vercel provides hosting and Neon provides database storage. Ora powers the separate agent-readiness audit and receives the public domain submitted for that audit. A scanned website receives Lightmark's server request and its crawler user-agent string. The Contact page links to Cal.com and GitHub; those services receive data when you choose to visit them and apply their own privacy terms.

Questions

Privacy questions, corrections, and deletion requests can be directed to Adam through the Lightmark contact page.