seo 0.13.2 → 0.14.0

package/PRIVACY.md

@@ -13,7 +13,7 @@ keeps your Search Console or analytics data, your reports or a log of your
 requests. When you first sign up it also notes how you found it: the
 sign-in path, the agent or app, and the site that sent you there. The only
 thing kept about your use is an anonymous usage count (the event, report,
-agent, version and week). Accounts in the weekly site audit beta also have
+agent, version and week). Accounts with the weekly site audit also have
 their audited sites' crawl results kept, as described below.
 
 The command-line tool runs on your machine. It does not create an SEO
@@ -68,6 +68,12 @@ Cloudflare D1 with only these things:
   used. A linked machine asks for short-lived Google and Bing tokens and your
   keys, and makes the Google and Bing requests itself. Nothing it fetches is
   sent back.
+- **How much metered work the server did for you.** One number a day per
+  kind of work: the browser time and pages the weekly audit rendered with
+  JavaScript, the Google URL Inspection checks made for you, and how many
+  research calls you made with each provider. It holds no URLs, page
+  content or research results. It is kept to
+  see what the hosted features cost to run.
 - **Beta features turned on for you.** The name of each beta feature the
   maintainer turned on for your account, and when. Only the maintainer sets
   these; most accounts have none.
@@ -96,12 +102,16 @@ it. The token your MCP client keeps carries only your person id.
 
 The server keeps nothing else. It does not keep reports, Search Console
 or Google Analytics rows, lists of your sites, or the pages it checked.
-Request logs are turned off. The one exception is the weekly site audit
-beta, below, and only for the sites you add to it.
+Request logs are turned off. The one exception is the weekly site audit,
+below, and only for the sites you add to it.
 
-### Weekly site audit (beta)
+### Weekly site audit
 
-The maintainer turns this beta on for chosen accounts; no one else has it.
+The weekly site audit is a paid plan, and the maintainer also turns it on
+for some beta accounts. If you pay for it, Stripe takes the payment and
+keeps your card details; the server keeps only your Stripe customer,
+subscription and open checkout ids, the subscription's status and how many sites you pay
+for. Deleting your account cancels the subscription.
 For each Search Console property you add on the account page, the server
 crawls the site once a week, up to 5,000 pages, as `SEOSkillBot`, and
 follows the site's `robots.txt`. It keeps, per site:
@@ -109,7 +119,9 @@ follows the site's `robots.txt`. It keeps, per site:
 - the property name, when you added it and when the next crawl is due;
 - the latest crawl and the one before it: each page's URL, status,
   redirect target, title, description, first heading, canonical, robots
-  settings, word count and the internal links on it with their link text;
+  settings, word count and the internal links on it with their link text,
+  and for pages rendered with JavaScript (below) the raw HTML's values where
+  rendering changed them;
 - the findings worked out from them (such as broken links or missing
   titles), with when each was first seen and resolved; resolved findings
   are removed after 90 days;
@@ -124,11 +136,26 @@ follows the site's `robots.txt`. It keeps, per site:
   read and add to the same results;
 - for each of those Search Console pages, its clicks and impressions in the
   last 28 days and its clicks in the 28 days before, replaced each day;
+- the issues list, only when you or your agent ask for it (`seo_report`
+  section `issues`): the striking distance, low CTR and quick win queries
+  and pages it found from Search Console (with their position, impressions,
+  clicks and CTR when last found), the crawl findings and index drops it
+  found, when each was found and checked, and what you marked each one,
+  with any note you gave; at most 500 issues per site;
 - how many URL Inspection checks each property used today;
 - how many pages a day Google can check for the site, and the folders worth
   adding as their own Search Console properties, with which of them you
   added from the account page.
 
+Some sites build their titles, canonicals and links with JavaScript. To
+read those, the crawl loads a few pages of each part of the site in
+Cloudflare Browser Run, a browser Cloudflare runs for the server, and if
+JavaScript changes what they show, it loads every HTML page of that part
+there too. It also loads pages whose HTML looks built by JavaScript. The
+server keeps which parts of the site need this for 28 days.
+Browser Run fetches the page from the site as `SEOSkillBot` and returns
+the page after its scripts run. The server asks it not to cache pages.
+
 If you click Create these in Search Console, Google asks you for
 permission to manage Search Console for that Google account. The server
 uses that permission once, to add the listed folders as properties and
@@ -166,7 +193,7 @@ Delete everything deletes it for every site.
 Sign in at [seoskill.dev/account](https://seoskill.dev/account) and choose
 **Delete everything**. It deletes your person id, linked accounts, keys,
 Clicky sites, linked machines, beta features, audited sites with their
-crawl data and how you signed up,
+crawl data, your plan's Stripe ids (after cancelling it) and how you signed up,
 and revokes the Google sign-ins. Your agents will ask you to sign in again if
 you use the hosted server later. You can also revoke SEO Skill in your
 [Google Account connections](https://myaccount.google.com/connections), which
@@ -230,7 +257,9 @@ The hosted MCP server itself does not read Bing data.
 ## How Google data is protected
 
 The software stores settings, OAuth tokens, cached API responses, and logs in
-local user directories. It does not save reports or crawls. It does not
+local user directories. It does not save reports or crawls, except the
+issues list you ask for with `seo report --section issues`, which it keeps
+in `issues.json` in its config folder. It does not
 upload Google API responses to a hosted SEO account or project database.
 Google API requests go directly from your machine to Google over HTTPS. The
 software does not send Search Console data to a research provider. `seo