Privacy policy

What ContextBolt is

ContextBolt builds tools that plug your own data into the AI assistants you already use. Bookmarks, SEO and Context Board are separate products with separate accounts. Page Insights has no account at all.

• ContextBolt Bookmarks: a Chrome extension that saves posts and web pages, with an optional endpoint so your AI tools can search what you saved.
• ContextBolt SEO: a paid MCP server that answers SEO questions inside your agent, with an optional Google Search Console connection and a web dashboard.
• Context Board: a web dashboard at board.contextbolt.com that displays your data in widgets and connects to the AI apps and tools you choose. Google Analytics and Google Search Console are optional, read-only connections, and Google Calendar is an optional connection that shows and changes the events in the calendars you choose.
• Page Insights for Search Console: a free Chrome extension that shows the Search Console numbers for the page you have open. It talks only to Google, and none of your data reaches us.

This policy covers these products and the contextbolt.com website. Every section below says which one it applies to. Bookmarks and SEO run on separate databases, so your bookmarks are never visible to the SEO tool and your SEO data is never visible to the Bookmarks extension.

The short version

• We never sell your data, and we run no advertising pixels.
• We never use your content to train AI models.
• We measure how the website is used, and we tell you exactly how below.
• You can ask us to delete everything we hold, and we do it within 7 days.
• We protect what we hold: it sits on encrypted disks at Cloudflare, everything moving between your browser, our servers and the services we use goes over encrypted HTTPS connections, and our addresses send any plain HTTP request to HTTPS, your Google tokens and the API keys you save on Context Board are encrypted again before we store them, and access inside ContextBolt is limited to what is needed to run and support the service.

The rest of this page is the detail behind those five lines, product by product.

Bookmarks: what the extension keeps

Everything you save lands on your own machine first, in your browser's IndexedDB. That covers the post or page text, the AI-generated tags, the topic it was filed under, and the search index. Nothing else leaves your device except the parts described below.

Bookmarks: how the extension reads a page

ContextBolt saves from four places, and each one works differently.

• X/Twitter: two ways. When you open your bookmarks page, the extension reads the bookmarks response the site already sent your browser. And when you press X's own bookmark button on a post anywhere on the site, it reads that post there and then. Either way it keeps the post text, the author and the metadata.
• Reddit: Reddit has no save button we can add, so the extension syncs your saved posts for you. While you are signed in and browsing any Reddit page, it asks Reddit for your saved list using the session you are already signed in with, and reads up to 3,000 of them. When that works it waits five minutes before checking again. When it fails, or when you have nothing saved, it may check again on the next Reddit page you open. It does not wait for you to open your saved page, and it reads nothing else you browse.
• LinkedIn: the extension adds a save button to feed posts. Posts you press save on are captured. If you have a LinkedIn data export, you can also import the saved-posts CSV from the extension's Settings page.
• Any other web page: when you click the ContextBolt icon and press Save this page, the extension reads the open tab once and keeps the title, the URL, the author if the page names one, and the main text. Up to 10,000 characters of that text are used for search and tagging, and a formatted copy of up to 100,000 characters is kept for ContextBolt Reader, which stays in your browser. Highlight a passage first and it saves your highlight instead of the article, as long as the highlight runs to more than about forty characters.
• A PDF: when you press Save this page on a PDF, the extension fetches the PDF the tab is showing, from the same address, and pulls its text out on your machine. That text is kept and used exactly like a web page's text. The PDF file itself is not stored or uploaded.

That last one is worth being precise about. The extension has no standing permission for the sites you browse. It uses activeTab and scripting, which means it can read the tab you are looking at, only at the moment you click the icon, and only that once. It is not watching your browsing in the background. Its standing site permissions are X, Reddit, LinkedIn and our own API, and nothing else.

The extension never touches your passwords, your direct messages, your private content, or anything beyond the posts and pages you choose to save.

Bookmarks: what goes to our servers

When a bookmark is processed, its text is sent to our API at api.contextbolt.app for three jobs.

• Tagging and topics using OpenAI's gpt-5.4-nano. Each bookmark comes back with 2 to 4 descriptive tags and a topic. If that call fails, the same request is retried with Anthropic's Claude Haiku, so your text can reach either company.
• Embeddings using OpenAI's text-embedding-3-small. These power related-bookmark suggestions in the extension, and search by meaning through the Pro endpoint.
• Naming your topics using the same OpenAI model as the tagging. Once your library is big enough to group, the author and the first 200 characters of up to five bookmarks from a group are sent so the group can be given a name and a description.

We do not keep the text after that. It is processed in memory and dropped once the answer goes back to your browser. Storing your library on our servers is a separate thing, and that is cloud sync below.

Two smaller things come out of that processing and are worth naming. We log one row per AI call with your account ID, which model ran, how many tokens it used and when, so we can watch what the AI is costing us. And the tags and topics that come back are cached for an hour against your account ID, so a retry does not pay for the same work twice. Neither holds the text of a bookmark.

The extension also tells us when you reach a handful of first-time milestones. Your first save, your first sync, the first time you hit the Basic limit, and whether you came back after a week. Each one is a milestone name, a timestamp and sometimes a count. None of them carries a bookmark. It is how we tell whether the product is any good at getting people started, and it happens on the free tier too.

Bookmarks: your account

Installing the extension creates an anonymous account so we can manage API access and rate limits. You can use Basic without a card. If you sign in during onboarding or in Settings, we store your email and its verification status so you can return to the same account. Signing in uses a short-lived email code, not a password.

Upgrading to Pro means giving us an email address and activating a license key. We store the email, the billing email Lemon Squeezy gives us if it differs, the license key and your API tokens. If you cancel and type a reason into the box, we keep that too, against your account. We use the email for account management, license checks and product emails you can unsubscribe from. We never sell it and never pass it to anyone outside the services listed further down this page.

Bookmarks: cloud sync (Pro only)

Pro syncs your library so the MCP endpoint can reach it. When it does, this is what sits in our Cloudflare database.

• Two copies of each bookmark saved by the extension. One is the raw capture, exactly as the extension read it, which is the platform's own response on an X or Reddit sync and the details taken off the page for a LinkedIn post or a saved web page. It is kept so a library can be rebuilt if something goes wrong. The other holds the title, author, text, URL and tags, and is the one the endpoint reads to answer your AI tool. A bookmark your AI tool adds through the endpoint has only that second copy. Saved web pages are stored at up to 2,000 characters, far less than the extension keeps on your machine.
• Embedding vectors, held in Cloudflare Vectorize. They are what makes search by meaning work.
• Topic cluster names, descriptions and counts.
• A record of each call your AI tool makes to the endpoint. The tool name, a short summary of the arguments, whether it worked, and how long it took. We use these to find broken tools, not to read your library.

We can read both of those copies, and you should assume we can. They sit on encrypted disks at Cloudflare, the same as everything else we store there, but that is storage security and not end-to-end encryption. There is no key that only you hold. Treat cloud sync as content we hold rather than content only you can open. Sync comes with Pro and runs on its own. If you would rather we did not hold your library, Basic keeps it on your machine. Text still passes through us for the three jobs above, and is never stored. Reminder emails are separate. If you set a reminder on a bookmark (Pro), its title, text, author and link go through our API to Brevo when we send it to you. The one exception is a bulk import on Basic. If a sync brings in more than your visible 150 at once, the overflow is parked on your machine unprocessed and its text is never sent. Anything you save one at a time does go through, because a new save is always the most recent.

Bookmarks: the MCP endpoint (Pro only)

Pro lets you connect an AI app using OAuth at https://api.contextbolt.app/mcp. You sign in with your account email, enter an email code, and approve access. Your existing personal URL with a token in its path also remains available for compatible clients. Either connection can search your synced bookmarks, export them, and add new ones. It cannot edit or delete what is already there.

The shared OAuth URL is not a secret. Your personal token URL is: anyone holding that one can read your library, so treat it like a password. Regenerating it from the extension invalidates old personal URLs. OAuth connections use separate credentials and should be disconnected from the AI app when no longer needed.

ContextBolt SEO: what we store

ContextBolt SEO is a paid subscription, so the product itself has no free tier. Subscribing creates an account holding your email, a private personal MCP token for compatibility, and your Lemon Squeezy subscription and customer IDs. The free tools on the website run without an account and are covered in their own section below.

Using the tool then builds up a record of your own research. That record is the product rather than a side effect of it, which is why it is kept.

• Your lookups: the keywords, domains and URLs you ask about, whether your agent runs the lookup or you run it from your dashboard, a short summary of each answer, and how often you have asked. This is what lets your agent remember what you looked at last month and tell you what has moved since.
• Site audits: the URLs, titles, descriptions and issues found on any domain you audit.
• Usage records: one row per tool call with the tool name, a short summary of the arguments, whether it worked, how long it took, what the data cost us, and which AI app made the call, or that it ran from your dashboard. These run your credit balance and show us when a tool breaks.
• Credit ledger: every credit granted and spent.
• Keyword lists: the name of each keyword list you make in your dashboard and the keywords you put in it. They stay until you change them or ask us to remove them.
• Visibility reports: if you run the full AI visibility report, the whole report is saved against your account so your dashboard can show it again without spending another credit. Those are kept until you ask us to remove them.

ContextBolt SEO no longer writes research to your own machine. Earlier versions mirrored findings into a ./seo-findings/ folder in your project. Any files already written are yours. They never come back to us and we cannot see them.

Bookmarks and SEO: sign-in and OAuth connections

We use your email to send sign-in codes through Brevo. Codes expire after 10 minutes. We store a hash of each code, the account or email it belongs to, its expiry and attempt count, and short-lived request limits based on your email and IP. The browser sign-in flow also uses an essential cookie to bind the request to the browser that started it and protect against forged requests.

When you approve an AI app, we store its registration, the permission grant and token records in Cloudflare. The app receives credentials for that product account, not your email code or legacy personal token. Access tokens last one hour; refresh tokens allow the app to renew access for up to 30 days. The connection remains subject to your current plan. Disconnect it from the AI app when no longer needed. Disconnecting does not cancel billing or delete your stored data.

The AI app receives the data returned by the tools you let it use, under that app's own privacy policy. Bookmarks and SEO have separate account and permission records. SEO's shared connection URL is https://seo.contextbolt.app/mcp. Any personal token URL remains a secret link; the shared OAuth URLs are not secret. Your SEO Dashboard does not use a secret link. You sign in to it, as described below.

ContextBolt SEO: Google Search Console

ContextBolt SEO can connect to your own Google Search Console so your AI agent can read your real search data. Connecting is optional and is never required to use the product.

• What we access: read-only, through the webmasters.readonly scope. That covers your search performance (clicks, impressions, click-through rate, average position, and the queries and pages behind them) and whether your pages are indexed. We never request write access and cannot change anything in your Search Console.
• How we use it: only to answer your SEO questions inside your own AI agent, and to draw your dashboard. We do not sell it, we do not share it, we do not use it for advertising, and we do not use it to train machine learning or AI models.
• How we store the connection: one encrypted credential, your Google refresh token, encrypted at rest. Short-lived access tokens live in temporary cache with an expiry and are never written to our database.
• How we store the results: when you ask a question, the answer is fetched live and is not kept. Your dashboard is the exception, in two ways. A nightly job saves a small snapshot of your top queries and headline numbers so the dashboard loads instantly instead of re-querying Google, and those snapshots are deleted automatically after 14 days. Separately, any query you pin to your dashboard is copied onto your account with its clicks, impressions, click-through rate and position, and refreshed nightly. A pinned query stays there until you unpin it.
• Your control: disconnect at any time by asking your agent to disconnect, or by removing ContextBolt SEO at your Google account permissions. Disconnecting deletes the stored credential immediately and stops anything new being fetched. Do it before you cancel if you want to do it yourself, because disconnecting runs through the MCP endpoint and the endpoint stops answering when a subscription ends. After that, email us and we delete the credential within 7 days. Revoking us at Google stops us using it either way, but it does not remove our copy. Snapshots age out within 14 days. Queries you pinned stay on your account until you unpin them or ask us to clear them.

ContextBolt's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

ContextBolt SEO: your dashboard

You sign in to your dashboard at seo.contextbolt.app/login with the email on your ContextBolt SEO account. We email you an 8-character code that works for 10 minutes, and we handle it like the other sign-in codes above, storing a hash of it and never the code itself. Only the email on the account can sign in. There are no teammate logins and no share link.

Once you enter the code, you stay signed in on that device for 30 days. We store a hash of that session with the account it belongs to and when it expires. Signing out from the dashboard's sidebar deletes it. Dashboard links from before sign-in still work, but they open the sign-in page first.

Context Board: your account and board

You sign in with an email code. We keep your email address, a hash of the code, and the session records needed to keep your account secure. Brevo sends the code. Cloudflare hosts your account, boards, widgets, notes, tasks, saved themes and the data your widgets display. When you subscribe, Lemon Squeezy tells us your subscription's status and its trial and end dates, and we keep them with your email so the board knows you have access.

Your board is private unless you turn on a public share link. Anyone with that link can see the shared board and its displayed data. An AI app you connect can read your board through the permissions you give it. If you ask your agent about the board, the relevant data can be sent to that AI provider to answer you.

API keys and connection tokens you save for data sources are encrypted at rest. Your AI provider processes requests under its own terms. The board's runner uses the Claude Code or Codex account on your computer, and sends the replies and requested board changes back to Context Board.

Context Board: Google Analytics and Search Console

Connecting Google Analytics or Google Search Console is optional. You choose the Google account and site for each connection, and what your widgets show.

• What we access: read-only Analytics reports through analytics.readonly, and read-only Search Console data through webmasters.readonly. Analytics includes users, sessions, page views and other reports you request. Search Console includes clicks, impressions, click-through rate, average position, queries and pages, submitted sitemaps and page indexing information. We also request openid and userinfo.email to identify the Google account you connected. We cannot change your Analytics settings or data, modify your Search Console sites or submit pages to Google.
• How we use it: to list the sites and properties your account can access, display the reports you choose, and refresh those widgets while a board is open. When you ask a connected AI app about your Google data, it can read reports through these connections and receive the results, as described above. We do not sell Google data, use it for advertising, or use it to train machine learning or AI models.
• How we store it: your access and refresh tokens are encrypted at rest in your workspace. We also keep your connected Google email address, site and property names and your selections. Report answers can be reused for 15 minutes between reads. The results saved to your widgets remain on your board, including the last good result if a later read fails.
• Your control: disconnect Analytics or Search Console from Connect at any time. That removes that connector’s stored Google connection and report cache and stops its refreshes. When no other Google connection for that account remains on your board, we also ask Google to revoke access. Disconnecting keeps the last displayed data on your board. You can remove saved data through the board's data controls, or ask us to delete it. You can also revoke access from your Google account permissions.

Context Board's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Context Board: Google Calendar

Connecting Google Calendar to a Calendar board is optional. You can connect more than one Google account, and you choose which of each account's calendars each board shows.

• What we access: your events, through the calendar.events scope, which lets the board see, create, change and delete events in your calendars; and the list of your calendars, with their names and colors, through calendar.calendarlist.readonly. We also request openid and userinfo.email to identify the Google account you connected. We cannot change your calendars' settings or who they are shared with, and we do not keep your events' guest lists.
• How we use it: to show the events of the calendars you choose on your Calendar boards, keep them current when Google tells us a calendar changed, and make the changes you make on the board in your Google calendar: a new event, a new time, title, place, notes, color or repeat, a Google Meet call, guests, your answer to an invitation, or a delete. A delete waits ten seconds before it reaches Google, so you can undo it. Google emails your guests only when you say so: the board asks first, and says "Google will email your guests" before it sends an invitation. When you answer an invitation, Google tells its organizer. When you ask a connected AI app about your calendar, it can read your events through this connection and receive them, as described above. AI apps cannot change your Google events through Context Board. We do not sell Google data, use it for advertising, or use it to train machine learning or AI models.
• How we store it: your access and refresh tokens are encrypted at rest in your workspace. We also keep the email address of each connected Google account, your calendars' names and colors, and which calendars each board shows. So that a board opens quickly and stays current, it keeps a copy of the events in the calendars your boards show, from three months back to a year ahead: each event's title, times and time zone, place, notes, color, link, video call link and whether it repeats, how many guests it has, your own answer, and who sent you an invitation. Who an event's guests are and their answers are read from Google when you open the event and are not kept. Dates further out are read from Google when you go to them and are not kept. Google tells us when a shown calendar changes through a notification that carries no event details.
• Your control: remove a Google account in Connect, Google Calendar, at any time. That stops its updates, deletes its stored events and connection, and asks Google to revoke access when no other Google connection on your board uses the same Google account. Hiding a calendar on every board stops keeping its events. You can also revoke access from your Google account permissions, which stops its updates; the board keeps the copy it has, marked out of date, until you remove the account in Connect.

How we protect it. Google gives the board an access token, which lasts about an hour, and a refresh token, which renews it. Both are encrypted with AES-256-GCM before they are stored, using a key held as a server secret apart from the database, and they are only ever sent to Google. All of it moves between your browser, our servers and Google over encrypted HTTPS connections. The board sends any plain HTTP request to HTTPS, and its Google sign-in runs only on https://board.contextbolt.com. The calendar data we keep sits on encrypted disks at Cloudflare. It is shown only on your own Calendar boards: a public share link and the coworkers you share a board with never see your Google events. An AI app you connect can read them, as described above. Access inside ContextBolt is limited to what is needed to run and support the service. We never sell your calendar data, use it for advertising, or use it to train AI models. Removing a Google account in Connect deletes its stored tokens and events at once. Asking us to delete your account deletes them along with everything else, within 7 days.

Context Board's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Page Insights for Search Console

Page Insights is a free Chrome extension that shows the Google Search Console numbers for the page you have open. It has no ContextBolt account and no ContextBolt server. It talks only to Google.

• What it asks Google for: read-only Search Console access through the webmasters.readonly scope, plus openid and email so it knows which Google account you connected. It cannot change anything in your Search Console.
• Where your data goes: your browser asks Google directly, and Google answers your browser. Your Search Console data, your Google sign-in and your email address are never sent to ContextBolt, and we cannot see them.
• What it reads in your browser: the address of the tab you are on, only when you click its icon, so it can look that page up. It does not read the page itself. That address goes only to Google, as part of the lookup.
• What it keeps, and where: Google's sign-in token, in your browser's temporary session storage, which clears when you close the browser. Google's answers, meaning your list of Search Console sites and the numbers for the pages you looked at, in the same temporary storage, for up to an hour, and whether a page is indexed for up to six hours. On your computer, in the extension's own storage: the email address of the Google account you connected, so it can stay signed in to that account, which metrics you last switched on, and a count of how many reports you have opened, so it knows when to ask for a rating.
• Analytics: the extension has no analytics and sends us nothing. Its links to contextbolt.com carry campaign tags, so the website analytics described below can tell that a visit came from the extension.
• Your control: Sign out, in the extension's menu, deletes everything above from your browser and asks Google to end the extension's access. Removing the extension deletes it too. You can also remove its access from your Google account permissions.

Page Insights' use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The free tools on the website

These free tools on contextbolt.com work without an account, and they hold different things from the products above.

• The Zero-Click Report: connects to your own Google Search Console to build a one-off report. It asks for one-time access rather than lasting access, so we never receive anything that would let us come back later, and there is no stored credential to leak or revoke. The access token sits in temporary storage for up to 10 minutes while you choose a property, and the finished report for up to 30 minutes. After that both are gone. The Google Limited Use commitment above covers this too.
• The AI Visibility Checker: you give it your brand or your domain, and a category if you want to narrow it, and it runs a free check. To get the full report you give an email address, and we email it to you. The brand and the category go to DataForSEO, who run the check for us. A domain is reduced to the brand name in it before anything is sent. We keep what you typed, the result and that email address, so the free check cannot be run over and over by the same person, and the record is kept against a one-way hash of your IP address rather than the address itself. There is no expiry on it. The email also goes to Brevo. Ask us and we delete the lot.
• The keyword box in the free guides: four of the guides let you check a keyword without signing up for anything. The keyword you type goes to DataForSEO to be looked up, and the answer is cached for a while so the next person asking the same thing costs nothing. We do not store who asked.
• The Keyword Difficulty Checker: the keyword you type and the country you pick go to DataForSEO to be looked up. The answer is kept for seven days so the next person who checks the same keyword costs nothing, and it is not linked to you. To hold each person to 10 checks an hour, we count checks against a one-way hash of your IP address, never the address itself, and that count is gone after about an hour.
• The Claude and Codex usage checkers: you pick a file from your own computer and the checker reads it in your browser. Nothing from the file is sent to us or anyone else, and nothing from it is saved. Session recording (Microsoft Clarity, described below) stops as soon as you go to choose the file, and the results are hidden from it.

Payments (every product)

Lemon Squeezy handles payment and is the merchant of record. We do not store card numbers, bank details or any payment credential. All of it is handled by their PCI-compliant infrastructure. See Lemon Squeezy's privacy policy.

Cookies and analytics (the website)

We measure how contextbolt.com is used, so we know which pages are worth writing and which ones are wasting your time. These run on the website only. None of them runs inside the extension or the board, and none can see your bookmarks, your boards or your SEO data.

• Google Analytics 4: the standard install. It sets its own cookies and records page views and clicks on our buttons. It is subject to Google's privacy policy.
• Microsoft Clarity: records how a page is used, meaning what the page showed, your clicks, scrolling and mouse movement, so we can replay a visit and see where a page confuses people, and it builds heatmaps from those visits. It sets its own cookies. It is subject to the Microsoft Privacy Statement.
• Our own counter: a small script that sends the page you are on, the page you came from, any campaign tags in the URL, your rough location, whether you are on a phone or a desktop, which of our buttons you click, and which links you follow off the site, to our own server. Rough location means the country, region and city your internet connection resolves to, which our host works out for us, and the coordinates of that place. It is the city, not your address, and it is often wrong by miles.
• What the counter uses to recognize you: a random ID stored in your browser, so a second visit is not counted as a second person. It is a random string, not your name and not your email. We do not store your IP address alongside it. Your IP is checked once, against a short list of browsers we leave out of our own numbers, and then it is not written down.

One thing the counter does that is worth spelling out. When you click through to checkout, that random ID travels with the order, so we can see which pages actually lead to a sale. If you buy, our analytics database ends up holding the ID, a one-way hash of your email address, and the order. That links the pages you read before buying to your purchase. We use it to work out which pages are worth writing and nothing else. The order record Lemon Squeezy sends us does carry your name and email, and it is deleted after 30 days.

All of this is used to understand traffic. We run no advertising pixels and we sell none of it. Google Analytics is Google's product and Clarity is Microsoft's, so what each does with its share is governed by their terms rather than ours. For Google, your Google ad settings are where you control that side of it.

Opting out: the counter honors a switch you set yourself. Open the browser console on contextbolt.com and run localStorage.setItem('cb_ignore', '1'), and that browser stops sending anything. For Google Analytics and Clarity, a tracker blocker or your browser's own protection will stop them, and we do not work around either.

The SEO Dashboard's sign-in cookie: the SEO Dashboard on seo.contextbolt.app sets a cookie when you sign in. It lasts 30 days, it is used only to keep you signed in, and it does no tracking. While you are entering your code, a short-lived cookie remembers the sign-in you started. It expires after 10 minutes and is removed once you sign in. Neither one is on contextbolt.com, and neither is used for analytics or advertising.

The website's email forms

Some pages on contextbolt.com ask for your email address. The free guides do, and so do the two quizzes. If you hand it over, we store your email, the page you were on, the site you came from, the campaign tags in the link you followed, your quiz score if you took one, and your IP address. Everything except the IP address also goes to Brevo, so we can send you the thing you asked for.

The IP address is there to stop the form being abused. Email us and the whole record goes.

Where we hold IP addresses

Our counter does not store one, but three other things do, so it is worth listing them in one place rather than leaving you to find them.

• The website's email forms: stored in plain, as described above.
• Bookmarks license checks: the extension checks in with us whenever its background worker starts, which in practice is every few minutes while your browser is open, and each check writes a row holding your account ID, the time, and your IP address. That adds up to hundreds of rows a day. It happens on the free tier too. We keep those rows.
• Rate limiting: Bookmarks and SEO count requests per IP address to stop abuse. Those counters live in temporary storage and clear themselves within the hour. Context Board counts sign-in codes and new app connections by network for the same reason. It counts only the last hour, and older counts are cleared as new sign-ins come in.

The AI Visibility Checker is the exception that goes the other way. It identifies you by a one-way hash of your IP rather than the address itself.

Third-party services

These are the companies that touch your data, and what each one sees.

• Cloudflare: hosting for the website, the APIs, the databases and the search index on Bookmarks, SEO and Context Board. Subject to Cloudflare's privacy policy.
• OpenAI: Bookmarks. Your bookmark text goes to them for all three jobs, the tags and topic, the embeddings, and naming your topic groups, under OpenAI's privacy policy.
• Anthropic: Bookmarks, as the standby. If a tagging request to OpenAI fails, that request is retried with Claude Haiku, under Anthropic's privacy policy.
• AI apps you connect to Context Board: the app or provider you choose can receive the board data you ask it to read and your conversation. Its privacy policy and your account settings apply. Your Google credentials are never included in those replies.
• DataForSEO: ContextBolt SEO, and the free tools on the website. The keywords, domains and URLs you ask about are sent to them to fetch the ranking, keyword, backlink and audit data you asked for, and anything you type into the AI Visibility Checker, the Keyword Difficulty Checker or a guide's keyword box goes the same way. They never see your email or your Search Console data.
• The AI assistants: ContextBolt SEO only, and only on the tools that put a question to an assistant and read the answer back. Ask one of them a question and it goes to ChatGPT, unless you name Claude, Gemini or Perplexity instead. Run the full visibility report and one live question goes to each of Perplexity, Claude and Gemini. The tools that only count mentions ask nobody anything; they read an index DataForSEO already holds. All of it goes through DataForSEO rather than direct.
• Google: our website uses Google Fonts and Google Analytics. Context Board also connects to Google Analytics and Google Search Console when you choose, as described above. Our typefaces are served from Google Fonts, so opening any page on contextbolt.com asks Google for the stylesheet and the font files, and that request carries your IP address and which page you are on. It happens before anything else on the page and a tracker blocker does not stop it. Our website Analytics is described above. Google Search Console is optional and read-only on ContextBolt SEO and Context Board, and yours to disconnect. The Page Insights extension talks to Google Search Console directly from your browser, as described above.
• Microsoft: the website only. Microsoft Clarity records how pages on contextbolt.com are used, as described above. It does not run on the board, the SEO Dashboard or the extension.
• Brevo: Bookmarks, SEO, and the website. It holds your email address, which tier you are on, and where you are in the trial or renewal cycle. If you came in through a form on the website, it also holds where you came from, the campaign tags and your quiz score. Our emails are sent through it, so anything inside one of them passes through Brevo. On ContextBolt SEO that includes your personal MCP URL and your dashboard link, which the trial and welcome emails contain so you can set the product up. For Context Board, Brevo receives your email address and sign-in code to send the sign-in email.
• Lemon Squeezy: every paid product: Bookmarks Pro, ContextBolt SEO and Context Board. Payment processing and license management.

Data retention

Bookmarks: the copy in your browser stays until you clear it or uninstall. The synced cloud copy stays while your account exists. If you cancel Pro, sync and the endpoint stop working, and the synced copy stays on our servers until you ask us to delete it.

ContextBolt SEO: your research lookups are kept until you ask us to remove them, whether or not you cancel. Dashboard snapshots are deleted after 14 days. Saved visibility reports and pinned queries have no expiry. If you cancel, the rest stays until you ask us to remove it.

Context Board: your boards and their displayed data stay until you remove them or ask us to delete your account. Deleted boards and widgets can remain in the board’s trash. Disconnecting Google removes its stored credentials and report cache immediately, but does not delete the values already saved to your board.

All products: ask us to delete your account and everything we hold for it goes.

Data deletion

The extension's Clear all data button in Settings wipes the copy in your browser. Bookmarks, tags, topics, the search index, all of it. It does not reach the synced cloud copy.

To delete the cloud copy, your SEO history, your Context Board data, or an account on any product, email hello@contextbolt.com. We do it by hand within 7 days and reply to confirm it is done.

Your rights

Under UK data protection law you have the right to access, correct or delete any personal data we hold about you. You also have the right to data portability and to object to processing. To use any of them, email hello@contextbolt.com.

Changes to this policy

We may update this policy as the products change. Material changes go out by email if you have an account with us, or through the extension. The "Last updated" date at the top of this page always reflects the most recent revision.

Contact

Questions about privacy? Email hello@contextbolt.com.