Privacy policy

Last updated October 17, 2026

What this policy covers

MoxyGrowth is a tool that plans and drafts search-focused content for websites you own. This policy describes what we collect, what we do with it, and how you remove it.

Information we collect

• Account details. Your email address and password, handled by our authentication provider. We never store your password ourselves.
• Properties you add. The domain names of sites you choose to track, and the settings you configure for them.
• Google Search Console data. If you connect Search Console, we read the search queries, clicks, impressions, click-through rate and average position for the site you select.
• Google Analytics data. If you connect Google Analytics, we read sessions, active users, engaged sessions, page views, traffic channels and landing pages for the site you select.
• Content you create. Articles generated or edited in the product, and the style settings that shape them.

Google Search Console access

When you connect Search Console we request exactly three scopes:

• openid and email: so we can tell you which Google account is connected. We read your email address from the sign-in token and store it to label the connection.
• https://www.googleapis.com/auth/webmasters.readonly: read-only access to the Search Console performance data for the site you select.

We request no write scope of any kind. We cannot modify your Search Console account, your website, or anything else in your Google account.

Connecting Search Console gives us a refresh token. It is encrypted with AES-256-GCM before it is written to our database, the encryption key is held separately in our hosting provider’s secret store, and the token is never sent to your browser. You can remove a connected Google account at any time from your account settings. This deletes the stored authorization and revokes our access at Google, so MoxyGrowth disappears from that Google account’s connected apps.

MoxyGrowth’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Analytics Access

When you connect Google Analytics we request exactly three scopes:

• openid and email: so we can tell you which Google account is connected. We store the email address to label the connection.
• https://www.googleapis.com/auth/analytics.readonly: read-only access to the Analytics reports for the GA4 property you pick.

We request no write scope. We cannot change your Analytics settings, your website, or anything else in your Google account.

We only read traffic for the site you added to MoxyGrowth. Every report is filtered to that site’s domain. If you added a single section of a site, the report is also filtered to that section’s path.

Connecting Google Analytics gives us a refresh token. It is encrypted with AES-256-GCM before it is written to our database. The encryption key is held separately in our hosting provider’s secret store. The token is never sent to your browser.

We refresh a snapshot of the reports once a day and show it on the Traffic page for that site. We do not combine it with data from other customers. We do not use it for advertising.

MoxyGrowth’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

We use it to operate the product: to show you how your site performs in search, to group your queries into related keywords, and to draft content. Article drafting sends the keyword and your style settings to a language-model provider.

We do not use your data to train our own models. Drafting runs through a third-party language-model provider that we choose on your behalf, and that provider’s own data policy governs what it does with the request, including whether it retains or trains on it. Which provider that is depends on your plan, and free and community-hosted models in particular may not offer the same guarantees as paid ones.

Data Protection

We protect everything we hold for you (account details, site data, content you create, and data from services you connect) with these measures:

• Encryption in transit. Every connection to MoxyGrowth, and between our servers and the services we rely on, uses HTTPS (TLS).
• Encryption at rest. Our database and its backups are encrypted at rest with AES-256. Credentials for connected services, such as Google refresh tokens, are also encrypted on their own with AES-256-GCM before they are stored, using a key kept separately in our hosting provider’s secret store.
• Credentials stay on our servers. Access tokens for connected services are never sent to your browser or shared with any third party.
• Account isolation. Every record is tied to one account, and the database itself enforces that a signed-in user can read only the accounts and sites they belong to.
• Least-privilege access. We ask connected services for read-only access only (for Google, read-only Search Console and Analytics scopes). Access to production systems is limited to the people who operate the service, and they use it only to run, support and secure MoxyGrowth.
• Deletion on request. The deletion paths described under Retention and Deletion remove your data immediately.

What we do not do

We do not sell your data, share it with advertisers, or transfer it to third parties except the infrastructure providers needed to run the service: our hosting, database and language-model providers.

Retention and deletion

We keep your search-query data while you continue to use MoxyGrowth, so we can show trends over time. Four deletions are available directly in the product, and all of them take effect immediately:

• Deleting a property removes that property and everything belonging to it: its stored search-query data and its Analytics traffic data.
• Removing a Google account (account settings › Search Console) deletes the stored authorization, and we then ask Google to revoke the grant itself.
• Deleting your account, from Account settings, permanently removes everything we hold for you: every property, article, style and stored search-query record, your marketing-list entry if you have one, and the login itself. Once that has completed we ask Google to revoke any Search Console grant. Deletion is immediate and we cannot reverse it or restore your data for you.
• Disconnecting Google Analytics (the site’s Preferences) deletes the stored authorization and the traffic snapshot right away. To remove MoxyGrowth from your Google account’s connected apps as well, use your Google account permissions page, linked below.

You can also withdraw our Search Console or Google Analytics access yourself at any time, without deleting anything here, from your Google account permissions page.

If you can no longer sign in and need your data removed, email privacy@moxygrowth.com and we will action it within 30 days.

Contact

Questions about this policy, or requests to access or delete your data: privacy@moxygrowth.com.