b/cited sees less than
you'd expect.
What b/cited receives
When you sign in, b/cited gets your Google email, name, and profile picture, plus a refresh token scoped only to Search Console (read-only). The refresh token is stored encrypted at rest with AES-GCM using a key in Cloudflare's secret store, and is used to pull your search analytics on your behalf and for no other purpose.
What b/cited reads
From Search Console: the last 90 days of query and page impressions, clicks, CTR, and average position. Stored in Cloudflare D1 in a project namespace tied to your user id. Queries are embedded with OpenAI's text-embedding-3-small via Cloudflare AI Gateway and stored in Vectorize, namespaced per project.
What b/cited doesn't do
- / Doesn't train on your data.
- / Doesn't sell or share with advertisers.
- / Runs no analytics or session-recording on the dashboard.
- / Never writes back to Search Console.
Cookies & local storage
b/cited sets only strictly necessary cookies. There are no analytics, advertising, or tracking cookies — and therefore no consent banner.
| Name | Purpose | Duration |
|---|---|---|
__Host-fr_session | Authenticates your signed-in session | 30 days |
__Host-csrf | Cross-site request forgery protection | Session |
cf_clearance | Cloudflare Turnstile bot verification (on /scan) | 30 min |
Your theme preference (fr-theme) is also stored in localStorage, which never leaves your browser.
Google API compliance
b/cited's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data b/cited receives from Google Search Console (webmasters.readonly) and Google Drive (drive.file) is used only to deliver the AEO/SEO features described above. b/cited does not transfer this data to third parties except as needed to provide or improve those features (Cloudflare for storage and compute, OpenAI for embeddings, Anthropic and Perplexity for AEO citation runs), does not use it for advertising, and does not allow humans — including b/cited's operator — to read the data except (a) with your explicit consent for specific items, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) in aggregated/anonymized form for internal operations.
Deletion
Delete your account from the dashboard at any time. Hard-delete from D1, Vectorize, and R2 — no soft-delete, no analytics tail.