Privacy
What is stored about you, who else it reaches, and how to get it back.
Effective 14 October 2026
Who is responsible
ShownTrue decides what is collected here and why. Write to privacy@showntrue.com about anything on this page.
Lemon Squeezy is the merchant of record for every purchase, which means they are the seller on your receipt and they hold your payment details. Their identity and address are on every invoice they send you, and their buyer terms cover the sale itself.
What is stored
Your account: an email address, a password that is stored only as a hash, and which workspaces you belong to.
So you can sign in and so the product knows what you are allowed to see.
Your websites and the pages found on them, including what each page said when it was read.
A page cannot be improved before somebody has read it, and comparing a page to what it used to say is the point.
The Search Console figures Google reports about your own site, kept by day.
They are what every suggestion is scored against.
Credentials you connect, such as a WordPress application password or a Google permission. These are encrypted and cannot be read back out of the database.
So the product can publish an approved change or read your figures without asking you again each time.
What your workspace subscribes to, and when it renews. Never your card, which only the payment provider sees.
So the product knows what you are entitled to without asking them on every page.
A record of what was changed, when, and who approved it.
It is the product. An audit trail that could be edited afterwards would not be one.
What is never stored
Payment card details do not reach this product. Passwords are kept only as a hash that cannot be turned back into the password. Credentials you connect are encrypted with a key held outside the database, so reading the database alone does not reveal them.
Who else it reaches
These are the only third parties any of your data is sent to. Each is listed with what actually leaves this system, rather than a category.
- SupabaseUnited States
The database and the account system.
Every record this product holds: your account, your workspaces, your crawls and your Search Console figures.
- ResendJapan
Sends account email: confirming your address, resetting a password, and invitations.
The address an email goes to and what it says, which for an invitation includes the workspace name and the role.
- VercelUnited States
Serves the website and runs the application.
Requests you make to the site, including your address and the pages you open.
- AnthropicUnited States
Writes and reviews content when you ask it to.
The text of the pages a document is written about. Never your credentials.
- Google (Search Console)United States
Returns your own Search Console figures, once you connect an account.
Nothing about you is sent for this. A read-only permission is held and used to read back what Google already knows about your site.
- Google Tag ManagerUnited States
Loads Google Analytics and Microsoft Clarity, after you accept where the law asks for that.
The address of the page being read, with anything identifying a customer’s workspace taken out, and the network address it is read from, because the browser fetches the container from Google. Which tags the container loads is set in Google’s interface rather than in this code, so it can change without a release here.
- Google AnalyticsUnited States
Counts visits and the actions this site reports, so we can see which pages and steps work.
The page address with workspace details taken out, how you arrived, your device and browser, your rough location from your network address, and named actions such as a button press, a sign-up or a crawl started. Never your name, your email address or anything you type.
- Microsoft ClarityUnited States
Records how pages are used, as heatmaps and recordings of a visit.
Clicks, taps, scrolling and mouse movement, the page address, your device and browser. Every form field is hidden from it, and in the signed-in product and on the sign-in pages all text is hidden too.
- Trigger.devUnited States
Runs crawls, imports and other work in the background.
The identifier of the job to run. The work itself reads from the database directly.
- AhrefsSingapore
Estimates of demand and of other sites linking to yours.
Domain names and keywords are sent to be looked up. Nothing about you or your account.
- Lemon SqueezyUnited States
Sells the subscription, takes payment, and handles sales tax and refunds.
Your email address and what you bought. Card details go to them and never reach this product.
- SlackUnited States
Notifies whoever runs this install when something needs a person.
Counts of what is waiting, and a workspace name. Never the content of anything.
What you can ask for
A copy of everything held about you, a correction, or deletion. Deleting an account removes its workspaces, their crawls and their imported figures. The audit record of what was published to a website is kept, because a record that can be erased by the person it describes is not an audit record; it is reduced to the action and the date.
If you are in the UK or the EU you may also complain to your data protection authority. In the UK that is the Information Commissioner's Office.
Measuring visits: Google Analytics and Microsoft Clarity
Every page of ShownTrue can load Google Tag Manager, which loads Google Analytics and Microsoft Clarity. We use them to see which pages people read, which buttons they press and where somebody gets stuck, so we can make the site and the product easier to use.
Google Analytics records the pages you visit, how you arrived, your rough location from your network address, your device and browser, and the actions this site reports to it: pressing a main button, following a link to another site, how far down a page you scrolled, using one of the free tools, a sign-up or sign-in form that was started or refused, and in the product, creating an account, signing in, sending an invitation and starting a crawl. It never receives your name, your email address, your password or anything you typed. In the product it receives each page's address with the parts that identify your workspace replaced, so a project page reports as /projects/[slug].
Microsoft Clarity records how pages are used: clicks, taps, scrolling and mouse movement, which it can play back as a recording of the page. Every form field is hidden from it, and in the product and on the sign-in pages all text is hidden too, so a recording shows the shape of a page and never your workspace, your address or your data. Clarity does see the address of the page, which for a project page includes the project's short name.
Both set cookies to tell one visit from the next. Google Analytics sets _ga and _ga_ followed by an identifier, kept for about 13 months. Clarity sets _clck for a year and _clsk for a day, and Microsoft sets MUID and a few others on its own domains, Clarity and Bing, for up to 13 months. What Google and Microsoft keep, and for how long, is set out in their own privacy statements. Nothing loads on an invitation link or a password reset link, because those addresses carry a secret.
If you are in the European Economic Area, the United Kingdom or Switzerland, none of this loads unless you press Accept on the banner. Everywhere else it loads by default. Wherever you are, you can change your choice here, and Reject stops it loading on every page after that.
Cookies
Signing in sets a cookie that keeps you signed in. It is necessary for the product to work and there is no way to use an account without it. The measurement cookies are described above, with the choice that controls them. That choice is kept in your browser's own storage for a year, and is never sent to us.