seo 0.4.2 → 0.6.0

package/PRIVACY.md

@@ -1,13 +1,14 @@
 # Privacy policy
 
-Last updated: 15 October 2026
+Last updated: 16 October 2026
 
 This policy covers the official `seo` command-line tool, library, MCP server,
 the hosted MCP server at seoskill.dev/mcp with its account page, and the
 seoskill.dev website.
 
-In short: the hosted MCP keeps only your linked Google accounts and any API
-keys you save, encrypted, so it can fetch your own data when you ask. It never
+In short: the hosted MCP keeps only your linked Google and Bing accounts, any
+API keys and Clicky sites you save and the machines you link, encrypted, so it can fetch your
+own data when you ask. It never
 keeps your Search Console or analytics data, your reports or a log of your
 requests. The only thing kept about your use is an anonymous usage
 count (the event, report, agent, version and week).
@@ -32,8 +33,26 @@ Cloudflare D1 with only these things:
 - **Your linked Google accounts.** The email address of each Google account
   you link, and its refresh and access tokens. You grant read-only access to
   Search Console and Google Analytics.
+- **Your linked Bing account, if you link one.** Its refresh and access
+  tokens, with read-only access to Bing Webmaster Tools, and a name made
+  from its sites.
 - **Your API keys, if you save them.** A DataForSEO login and password and an
   Ahrefs key.
+- **Your Clicky sites, if you save them.** Each site's numeric site ID,
+  sitekey and domain. The domain comes from Clicky when you save the site,
+  so agents can name the site.
+- **Your Clicky account login, if you save it.** Your Clicky username or
+  email and your Clicky password. Clicky has no other way to list an
+  account's sites, so the server keeps the password, encrypted, and uses it
+  only to read your Clicky site list: when you save it, and again when an
+  agent asks for a Clicky site that is not saved yet. The password is never
+  sent to a linked machine. Remove it on the account page, and change your
+  password at Clicky if you want to be sure it no longer works.
+- **Machines you link with `seo login`.** A name such as "seo on
+  my-laptop", made from the machine's host name, and the date it was last
+  used. A linked machine asks for short-lived Google and Bing tokens and your
+  keys, and makes the Google and Bing requests itself. Nothing it fetches is
+  sent back.
 
 Every token and key is encrypted with a server key before it is written. The
 tokens are used only to fetch your own data when you or your agent ask for
@@ -43,17 +62,21 @@ The server keeps nothing else. It does not keep reports, Search Console
 or Google Analytics rows, lists of your sites, or the pages it checked.
 Request logs are turned off.
 
-- **Your data.** Search Console, Google Analytics and provider responses are
+- **Your data.** Search Console, Google Analytics, Clicky and provider responses are
   fetched for each request, returned to your MCP client and not kept. Pages checked live are fetched for the request and not kept.
 - **API key headers.** You can send `X-DataForSEO-Login`,
   `X-DataForSEO-Password` and `X-Ahrefs-Key` headers instead of saving keys.
   A header wins over a saved key and is used for that request only.
 - **The account page.** At [seoskill.dev/account](https://seoskill.dev/account)
-  you sign in with Google to see your linked accounts, add or remove them,
-  and save or remove keys. It sets one essential cookie that holds your
+  you sign in with Google to see your linked accounts, keys and machines,
+  add or remove them, approve a `seo login`, and make a token for a cloud
+  agent. It sets one essential cookie that holds your
   encrypted person id for up to 30 days.
 - **Outside services.** Google answers its own requests. The provider you
-  choose receives your research request under its own policy.
+  choose receives your research request under its own policy. Clicky
+  receives the site ID, sitekey, report types and dates for a Clicky request,
+  and your Clicky username and password when the server reads your Clicky
+  site list.
   Ahrefs receives the domains in research rows for the free Domain Rating
   column. Cloudflare runs the server, stores the encrypted data and handles
   the network requests.
@@ -64,7 +87,8 @@ Request logs are turned off.
 ### Delete your hosted data
 
 Sign in at [seoskill.dev/account](https://seoskill.dev/account) and choose
-**Delete everything**. It deletes your person id, linked accounts and keys,
+**Delete everything**. It deletes your person id, linked accounts, keys,
+Clicky sites and linked machines,
 and revokes the Google sign-ins. Your agents will ask you to sign in again if
 you use the hosted server later. You can also revoke SEO Skill in your
 [Google Account connections](https://myaccount.google.com/connections), which
@@ -100,7 +124,9 @@ including its Limited Use requirements.
 
 ## Clicky data the software can access
 
-Clicky access is optional. If you connect a site, the software sends its numeric
+Clicky access is optional. The hosted server and a CLI linked with
+`seo login` use the Clicky sites saved on your account, as described above.
+If you connect a site on your machine, the software sends its numeric
 site ID, sitekey, requested report type, date range, and row limit directly to
 Clicky over HTTPS. It can read the traffic data that sitekey permits. The
 project maintainer does not receive the request or response.
@@ -118,8 +144,10 @@ save a Bing Webmaster API key with `seo providers bing connect`, or set
 `SEO_BING_API_KEY`. The key is saved in the system keychain when available,
 with a private local file fallback. Requests go directly from your machine to
 Bing over HTTPS and can read the sites that key can read. Run
-`seo providers bing disconnect` to remove the saved key. The hosted MCP
-server does not read Bing data.
+`seo providers bing disconnect` to remove the saved key. A machine linked
+with `seo login` can instead use the Bing account linked on seoskill.dev:
+the server hands it a short-lived token and the machine calls Bing directly.
+The hosted MCP server itself does not read Bing data.
 
 ## How Google data is protected
 

package/README.md

@@ -209,18 +209,18 @@ seo analytics google properties
 seo ai-referrals --property 123456789
 ```
 
-Clicky is available through the
-[Clicky provider package](https://github.com/iannuttall/seoskill-clicky-provider).
-Install it, then connect a site with its Clicky site ID:
+For Clicky, save your Clicky account login (every site) or one site's ID and
+sitekey on your [account page](https://seoskill.dev/account#clicky). The
+hosted server and a CLI linked with `seo login` both read them:
 
 ```sh
-seo providers install @seoskill/clicky-provider
-seo analytics clicky connect --site-id 12345
+seo data --source clicky --site example.com
 ```
 
-The hosted server reads Google Analytics only. Clicky runs on your machine,
-and the hosted server tells your agent to use the CLI for it, as it does for
-crawls. For any other analytics tool, build a provider package with the
+A site saved on your machine with the
+[Clicky provider package](https://github.com/iannuttall/seoskill-clicky-provider)
+(`seo analytics clicky connect --site-id 12345`) works too, by its site ID.
+For any other analytics tool, build a provider package with the
 public provider SDK; the Clicky package is the example. Each source keeps its
 own metric names, so a Clicky visit is never relabelled as a Google Analytics
 user.