seo 0.11.0 → 0.12.1

package/PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy policy
 
-Last updated: 20 October 2026
+Last updated: 22 October 2026
 
 This policy covers the official `seo` command-line tool, library, MCP server,
 the hosted MCP server at seoskill.dev/mcp with its account page, and the
@@ -13,7 +13,8 @@ keeps your Search Console or analytics data, your reports or a log of your
 requests. When you first sign up it also notes how you found it: the
 sign-in path, the agent or app, and the site that sent you there. The only
 thing kept about your use is an anonymous usage count (the event, report,
-agent, version and week).
+agent, version and week). Accounts in the weekly site audit beta also have
+their audited sites' crawl results kept, as described below.
 
 The command-line tool runs on your machine. It does not create an SEO
 account, upload reports to a hosted SEO service, or send reports or connected
@@ -38,6 +39,18 @@ Cloudflare D1 with only these things:
 - **Your linked Bing account, if you link one.** Its refresh and access
   tokens, with read-only access to Bing Webmaster Tools, and a name made
   from its sites.
+- **Search Console folders you add from the Beta tab.** "Create these in
+  Search Console" asks Google, at that moment, for permission to add and
+  manage your Search Console properties. The server uses it once, to add
+  the folders listed on the page, and does not keep that permission or its
+  token. It keeps which folders it added and whether Google verified them.
+- **Alerts, for accounts in the weekly-audit beta.** Which alerts you want
+  by email and by webhook, your webhook URL and its signing secret, and
+  each alert sent in the last 30 days: the site, the pages that changed
+  and whether it was delivered. Alert email goes to your first linked
+  Google account's address through PostShiba, our email provider, which
+  receives that address and the alert's text to send it. A webhook gets
+  the same alert at the URL you save.
 - **Your API keys, if you save them.** A DataForSEO login and password, an
   Ahrefs key and a TypeSafe key.
 - **Your Clicky sites, if you save them.** Each site's numeric site ID,
@@ -55,6 +68,9 @@ Cloudflare D1 with only these things:
   used. A linked machine asks for short-lived Google and Bing tokens and your
   keys, and makes the Google and Bing requests itself. Nothing it fetches is
   sent back.
+- **Beta features turned on for you.** The name of each beta feature the
+  maintainer turned on for your account, and when. Only the maintainer sets
+  these; most accounts have none.
 - **How you signed up.** Written once, when your person id is created, and
   never changed:
   - the way you signed up: an MCP client, the account page, or `seo login`;
@@ -80,7 +96,47 @@ it. The token your MCP client keeps carries only your person id.
 
 The server keeps nothing else. It does not keep reports, Search Console
 or Google Analytics rows, lists of your sites, or the pages it checked.
-Request logs are turned off.
+Request logs are turned off. The one exception is the weekly site audit
+beta, below, and only for the sites you add to it.
+
+### Weekly site audit (beta)
+
+The maintainer turns this beta on for chosen accounts; no one else has it.
+For each Search Console property you add on the account page, the server
+crawls the site once a week, up to 5,000 pages, as `SEOSkillBot`, and
+follows the site's `robots.txt`. It keeps, per site:
+
+- the property name, when you added it and when the next crawl is due;
+- the latest crawl and the one before it: each page's URL, status,
+  redirect target, title, description, first heading, canonical, robots
+  settings, word count and the internal links on it with their link text;
+- the findings worked out from them (such as broken links or missing
+  titles), with when each was first seen and resolved; resolved findings
+  are removed after 90 days;
+- a one-line summary of each of the last 52 crawls (counts only);
+- Google's URL Inspection result for each known URL of the site (the
+  sitemap's, the crawl's and the Search Console pages with clicks or
+  impressions, up to 50,000 from the sitemap and crawl): its indexing
+  reason and Google's details, when it was checked and is due again, the
+  reason before it last changed, and when it last dropped out of or came
+  back to Google's index. The server checks these in the background each day, within
+  Google's 2,000 checks a day per property, and `seo_page` and `seo_index`
+  read and add to the same results;
+- for each of those Search Console pages, its clicks and impressions in the
+  last 28 days and its clicks in the 28 days before, replaced each day;
+- how many URL Inspection checks each property used today;
+- how many pages a day Google can check for the site, and the folders worth
+  adding as their own Search Console properties, with which of them you
+  added from the account page.
+
+If you click Create these in Search Console, Google asks you for
+permission to manage Search Console for that Google account. The server
+uses that permission once, to add the listed folders as properties and
+read back whether each is verified. It asks for no refresh token and
+keeps no token afterwards.
+
+Remove a site on the account page and all of this is deleted at once.
+Delete everything deletes it for every site.
 
 - **Your data.** Search Console, Google Analytics, Clicky and provider responses are
   fetched for each request, returned to your MCP client and not kept. Pages checked live are fetched for the request and not kept.
@@ -109,7 +165,8 @@ Request logs are turned off.
 
 Sign in at [seoskill.dev/account](https://seoskill.dev/account) and choose
 **Delete everything**. It deletes your person id, linked accounts, keys,
-Clicky sites, linked machines and how you signed up,
+Clicky sites, linked machines, beta features, audited sites with their
+crawl data and how you signed up,
 and revokes the Google sign-ins. Your agents will ask you to sign in again if
 you use the hosted server later. You can also revoke SEO Skill in your
 [Google Account connections](https://myaccount.google.com/connections), which
@@ -200,14 +257,17 @@ local token record.
 
 Google Analytics and Search Console API responses are cached locally so repeat
 commands do not make the same request unnecessarily. A cached response is
-eligible for reuse for up to 24 hours. Expired cache rows are removed during
+eligible for reuse for up to 24 hours. URL Inspection results (Google's index
+status for each URL, keyed by property and URL) are kept so `seo index` can
+page through or repeat a result without asking Google again; each is reused
+for up to 7 days. Expired cache rows are removed during
 automatic cache maintenance, which also removes cache rows older than 30 days
 and enforces local size limits. On a machine where the command is no longer
 run, expired rows may remain in the local cache file until you delete them.
 
 Run `seo cache clear --provider google-analytics` to remove cached Google
 Analytics responses immediately. Run `seo cache clear --provider gsc` to do
-the same for Search Console. Run `seo cache clear --provider clicky` to remove
+the same for Search Console, including saved URL Inspection results. Run `seo cache clear --provider clicky` to remove
 cached Clicky responses. Settings and saved provider credentials remain until
 you delete them with the relevant command or run `seo reset --yes`. The reset
 command removes Google tokens, local configuration, caches, logs, any
@@ -331,9 +391,10 @@ contain the raw error or command arguments. Nothing is sent to GitHub unless
 you open the link, and you can review the form before submitting it.
 
 Aggregate event counts are public at
-[seoskill.dev/stats](https://seoskill.dev/stats). Failure counts are not
-shown there; the maintainer reads them privately to find and fix bugs,
-including a weekly Telegram message with failure totals by version. The
+[seoskill.dev/stats](https://seoskill.dev/stats). Failure counts, setup
+completions and retention are not shown there; the maintainer reads them
+privately to find and fix problems, including a weekly Telegram message with
+failure totals, first audit rates and retention by version. The
 public counts are described as installs, active machines, and audits, never
 users. One person can have several installs, and clearing local state creates
 a new install.

package/README.md

@@ -145,7 +145,7 @@ ends with the command to run next, so your agent always knows where to go.
 | [`seo report`](https://seoskill.dev/docs/report) | Your Search Console overview, then the top rows of each section |
 | [`seo page`](https://seoskill.dev/docs/page) | One URL: the live page, its Google index status and its queries |
 | [`seo compare`](https://seoskill.dev/docs/compare) | Before and after a date, with Google updates |
-| [`seo index`](https://seoskill.dev/docs/indexing) | Pages that lost their clicks, checked live and with Google |
+| [`seo index`](https://seoskill.dev/docs/indexing) | Google's indexing reasons for known URLs, labelled from live checks, and pages that lost their clicks |
 | [`seo research`](https://seoskill.dev/docs/research) | Keywords, search results, competitors and backlinks from your own key |
 | [`seo data`](https://seoskill.dev/docs/data) | Raw Search Console or Bing rows |
 | [`seo analytics`](https://seoskill.dev/docs/analytics) | Landing pages from Google Analytics or Clicky |