Privacy Notice
How Rookglint handles account information, enquiries and analytics from connected websites and apps.
Operator-published guides
Rookglint publishes approved public guides and sends their own public URLs to participating IndexNow search engines when content changes. Publication state stores a content hash, target HTTP status and submission/check times. Links to Dafpuno use public campaign labels. Aggregate outbound request counters retain only publication, UTC day and count for 30 days; no IP, full user-agent, visitor/session identifier or cookie is stored in this counter. Known robot and prefetch signals are inspected transiently to exclude obvious automation; accepted requests are not proof of unique humans. These counts are separate from optional consent-gated customer analytics. HTTP/security providers still process network information to deliver the service. Search notification receipt does not establish indexing, impressions, visitors or sales.
Cloudflare bot protection
When configured, account access, registration, password recovery, email verification and enquiry forms use Cloudflare Turnstile to reduce automated abuse. The browser connects to Cloudflare, which receives network and device/browser challenge signals. The server sends the short-lived challenge token to Cloudflare for verification and checks the expected hostname and form action. We do not intentionally retain challenge tokens in application records or include email/password fields in verification requests. This security mechanism is separate from optional analytics and is not evidence that every accepted request is human. Cloudflare must be included in the operator's actual provider/privacy review; legal notices remain drafts until that review and operator details are complete.
Backend campaign measurement
With analytics consent, customer backends can send random event identifiers, one of four supported funnel event names, bounded tool labels, clean page paths, UTC event times, campaign/source/medium/publication labels and a test flag. No session or visitor identifier is required by this endpoint. Events are reports from the customer backend; they do not prove unique people, human traffic or a contact enquiry. Test reports remain separate from live results. Event identifiers prevent duplicate delivery within the property retention window. Records follow the property retention period, are included in owner account export and are removed on property/account erasure. Do not send Steam IDs, email, trade URLs, contacts or other personal identifiers. Omitting these fields does not by itself establish that all processing is anonymous or exempt from applicable duties.
Optional public-source research
When a property owner enables public-source research, Rookglint sends one to three selected public business topics to the selected public source: the Hacker News search service through Algolia, or the YouTube Data API operated by Google. YouTube search uses a protected operator-owned API key; customer Google accounts are not connected by this feature. The API returns public video references, not private account data. Do not enter private customer details or personal identifiers. The service receives the query and the platform server's network connection information. We retain matched public discussion or video identifiers, short titles, canonical links, dates, matched topics and review status for up to 30 days; author profiles, contact details, full post bodies and private data are not intentionally collected. Owners can disable future searches, export the records or erase their property/account. A search result is not a confirmed lead, publication permission or evidence of visits. Requests are read-only; this feature does not contact authors or post messages. Production operator review of this source and processing remains required.
Functional marketing and website SEO
After explicit owner approval, Rookglint can also publish a real moderated business offer through an operator-owned publishing channel, independently of the customer's social accounts. The approved channel destination and delivery status are retained with the campaign. Only the moderated public offer and its tracked customer-site link are sent; no visitor data or private campaign copy is sent to that platform channel. Operator account configuration does not establish audience size or geographic reach. The independent marketing.js module requests only public moderated business offers for a verified property and renders them in an explicitly installed page block. It stores no browser identifier, cookie or analytics event and does not start tracker.js. The property key and network connection information are processed to deliver that block; hosting/proxy log settings require separate operator review. Installing analytics remains optional and collection still requires explicit consent. After a property owner explicitly approves direct search discovery, the platform verifies a public key file on the customer's domain and sends the approved public landing-page URL, host and verification key to IndexNow participants. No visitor identifier, enquiry or private page content is included. Delivery and retry metadata are retained with the campaign until property/account deletion. Search-engine receipt is not indexing or a visit. A customer's optional WordPress connector can cache public brand metadata for five minutes, output homepage SEO markup and, after the WordPress administrator enables IndexNow, send changed public post/page URLs, the site host and a public verification key to IndexNow participants. These requests originate from the customer's WordPress host, not a visitor profile. No private/draft/password-protected post is intentionally submitted. Customer administrators must review their own privacy notice, provider terms and host configuration before activation. Search indexing, rankings, audience and purchases are never guaranteed.
Optional audience campaigns
An owner may save topic-specific campaigns and explicitly approve discovery/RSS publication or a scheduled message to a Telegram channel they control. We store campaign text, destination, channel metadata, approval/schedule/status and provider message reference; bot tokens are encrypted and excluded from exports. Telegram receives the approved message and channel identifier only after activation; connection verification contacts Telegram without publishing. Redirect metrics store campaign/channel/time without IP, user agent or browser identifier. Known crawler/preview agents are omitted; remaining redirects are unverified requests, not unique people. Consented browser sessions and configured goal events are separate. Redirect rows follow the property analytics retention period; campaigns and delivery records remain until account/property deletion. Pausing prevents pending delivery and disables tracked links; already published external posts require removal at the provider. Automated distribution does not guarantee an audience or human-only traffic. No marketing email is sent. The operator must review provider roles, transfer safeguards and the legal basis for proportionate redirect measurement before public launch.
Who is responsible
Service operator: Not yet specified. Address: Not yet specified. Privacy contact: [email protected]. The operator controls account, security and service administration data. Customers control visitor and enquiry data from their sites; the operator processes that data on their documented instructions.
What we collect
Account email, password hash, workspace details, accepted document versions and security sessions. When an explicitly trusted ingress is configured, short-lived abuse counters use a hash of the action and ingress-provided IP address; raw addresses are not stored in these counters. These are pseudonymous security records, not analytics visitor identifiers. Counters expire by their configured window and expired rows are removed by subsequent limiter use or hourly retention cleanup. Optional company listings and enquiries include the details deliberately submitted in those forms. Connected-site analytics include redacted page paths, event names, coarse device class, browser and operating-system family, optional country code from a configured trusted edge or customer backend, optional approximate region/city/timezone only when the property owner enables detailed geography, source/campaign labels, one-way per-property hashes of random session and optional browser identifiers, and optional EUR revenue amounts sent by the customer backend. These analytics records are pseudonymous, not claimed to be anonymous. We do not intentionally collect raw IP addresses, full user agents, precise location, payment card details or free-form visitor properties in the analytics database. Network/hosting providers may process connection information; their logging configuration must be reviewed before production.
Purposes and legal bases
Account administration, requested service delivery and handling enquiries rely on contract or steps requested before a contract. Proportionate security measures may rely on legitimate interests, subject to an assessment. Optional analytics using browser storage require a separate choice and are off until consent. Statutory obligations apply where required. Accepting terms is separate from analytics consent; withdrawing analytics does not close your account. Paid advertising controls operate only after a property owner connects an advertising account and explicitly approves a campaign, budget settings and stop conditions. No marketing email campaign is sent automatically.
Recipients and transfers
Configured hosting region: Local development machine; production region not selected. Configured service providers: Local development only; production providers not selected. We do not sell data. Customer enquiry recipients are identified on each form. Production provider contracts, subprocessors, transfer safeguards and access permissions must be confirmed before launch. No assertion of EU-only hosting is made while these fields remain unconfigured.
Storage and retention
Analytics events use the per-site retention setting: 30, 90, 180 or 365 days, with 90 days as default. The standard pnpm start runner enforces retention at startup and hourly; deployments bypassing it must schedule equivalent cleanup. Privacy-choice records expire after 180 days; sessions after seven days; reset links after 30 minutes; verification links after 24 hours. Account and company records remain until deleted or a separately documented lawful retention need applies. Local development email messages expire after 24 hours through the same cleanup task. Project-generated backups expire after 30 days by default (configurable); a private deletion-request journal outside PostgreSQL prevents validated account/property/session/browser erasures being undone on restore. Restored databases are quarantined with collection disabled and integrations requiring reconciliation. The journal must outlive every restorable copy; production offsite storage, protection and operating procedures still require verification.
Your choices and rights
Use Privacy choices to reject or withdraw optional analytics. Account settings provide JSON export and password-confirmed account deletion. Account holders can correct their profile in the workspace. For access, rectification, erasure, restriction, portability, objection or visitor requests, contact the operator at the contact above; visitors of a customer site should contact that site owner first. The controller normally responds within one month, with any permitted extension explained. You may complain to your competent data protection authority. No automated decisions with legal or similarly significant effects are offered.
Optional integrations and account billing
If connected, Stripe payment analytics process only hashed payment/session references, EUR amounts and approved campaign labels; full webhook bodies, card details, emails and customer names are not stored in analytics. Workspace subscription billing stores Stripe customer/subscription references and status so you can manage or cancel the plan. Google Ads integration credentials are encrypted with a separate application key; only the owner can approve campaign control. Stripe and Google receive requests only when those integrations are configured. Their actual roles, terms, transfers and processing agreements must be reviewed by the operator and customer before activation.
Deletion limits
Account deletion first attempts to pause approved active advertising and cancel stored active workspace subscriptions; a provider failure stops the request so ongoing charges are not silently abandoned. A durable deletion intent blocks new checkout, billing-portal and advertising activation. Live replay repeats provider reconciliation before removing local references and retains them on provider failure. Quarantined restores never contact providers and stop for manual reconciliation when erasure would discard financial references. After those actions succeed, deletion removes active account records, connected sites, analytics, received enquiries and owned listings. Partner attribution is removed from other companies’ enquiries without deleting their independent customer records. Deleting a service account does not automatically delete messages you submitted independently to other businesses; those recipients handle the corresponding request. Backups and any legally required retention need a documented, limited process.
Source framework: GDPR and EDPB consent guidance. Customer-specific legal assessment and production review remain necessary.