Who this policy covers
This Privacy Policy explains how HIII PTE. LTD ("HitMind", "we", "us", or "our") collects, uses, discloses, and protects information when you use hitmind.ai and the HitMind application at hitmind.ai/app (together, the "Services"). It applies to visitors of our website and to registered users of the product. By using the Services, you agree to the collection and use of information as described in this policy.
Information we collect
We collect the information needed to run the audits, drafting, and publishing features you use, grouped into the following categories.
Account and identity
When you sign up, our account system verifies your identity either by sending a one-time verification code to your email address, or through Google Sign-In (OAuth). We store your email address and, if you provide it, your name. We do not store your Google account password — Google authenticates you directly and shares only your email address and basic profile with us.
Sites you connect
The domain names and URLs of the sites you add to HitMind, so we know what to audit, monitor, and, if you choose, publish to.
Google Search Console data (read-only, by your authorization)
If you connect Google Search Console, you go through Google’s own OAuth consent screen and grant HitMind read-only access, scoped to https://www.googleapis.com/auth/webmasters.readonly. We read the search performance data for the properties you authorize — search queries, impressions, clicks, click-through rate, average position, and indexing status — and use it inside your audits, dashboards, and reports. We never request write access to your Search Console property.
WordPress connection credentials
If you connect a WordPress site so HitMind can publish drafts on your behalf, you provide connection credentials, such as an application password. We store these credentials encrypted at rest and use them only to deliver content to that site that you have approved, or that automatic drafts approved under settings you turned on.
AI-drafted content
The audits, briefs, article drafts, and other content our AI features generate for you, based on the data above and any instructions you provide.
Product usage data
Pages viewed, features used, clicks, timestamps, device and browser type, and IP address, collected through basic product analytics so we can see what is working, debug issues, and keep the Services secure.
Local browser storage
Your session token, which keeps you signed in, and interface preferences such as light or dark theme and language, are stored in your browser’s local storage. Local storage specifically is not sent to our servers — cookies, described next, are a separate thing and are sent with every request.
Cookies
Our servers set a device identifier cookie (ipalfish_device_id) the first time you load any page on this site, including before you sign in. It is a random value with no name, email or account attached, and it is sent to our servers with every request. We use it for one thing: tying together the requests from a single browser in our server logs, so we can debug a problem or investigate abuse. It does not feed our product analytics — those run on a per-visit identifier kept in your browser's session storage, which is gone when you close the tab and is never sent as a cookie. We do not sell this cookie, and we do not use it for advertising, profiling or cross-site tracking.
You can delete it at any time by clearing cookies for this site; the site keeps working, and a new identifier is issued on your next visit. Because it exists only to make our own logs readable — not to measure you — we treat it as strictly necessary and do not ask for consent for it. Its current expiry (into 2036) is longer than that purpose needs, and shortening it is on our list; this paragraph will say so when it changes.
How we use this information
- Provide the Services you sign up for: run audits, generate briefs and drafts, surface Search Console insights, and deliver content you approve, or that your automatic settings approve on your behalf.
- Authenticate you and keep your account secure.
- Maintain and improve HitMind: diagnose bugs, understand which features are useful, and plan what to build next.
- Communicate with you about your account, service changes, or support requests.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell your personal information, and we do not use it to serve you third-party advertising.
Google user data — Limited Use disclosure
HitMind’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We only use Google user data — your Search Console performance metrics — to provide or improve user-facing features that are prominent in the HitMind product: surfacing that data inside your audits, dashboards, and reports so you can see how your content performs.
- We do not use Google user data to serve advertisements of any kind, including retargeted, personalized, or interest-based advertising.
- We do not allow humans to read Google user data, except where: (a) we have your affirmative agreement for specific messages or data; (b) it is necessary for security purposes, such as investigating abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized.
- We do not transfer Google user data to third parties, except as necessary to provide or improve the user-facing features described in this policy (the infrastructure and AI-model subprocessors listed below), to comply with applicable law, as part of a merger or acquisition with notice to you, or with your explicit consent.
We do not sell your data
We have never sold, and do not sell, personal information or Google user data to third parties for money or for their own marketing purposes.
Who we share data with
We use a small number of service providers to run HitMind, and share data with them only as needed to provide the Services, under agreements that require them to protect your data:
- Our account and identity system — verifies your identity by email code or Google Sign-In, and issues your session.
- Cloud infrastructure providers — host our application, databases, and backups.
- AI model providers — process the inputs needed to draft audits, briefs, and articles on your behalf.
- Email delivery provider — sends verification codes and transactional emails, such as export notifications.
We do not permit any of these providers to use your data for their own purposes.
Where we store data, and for how long
The Services and the data described in this policy are hosted and processed in our designated international infrastructure region. If you cancel your subscription, your paid plan stays active until the end of the current billing period; after a 72-hour grace window your workspace moves to the free plan, with the free plan's limits. Cancelling does not delete anything: your workspace, drafts and receipts stay in your account until you ask us to delete them, and you can download your receipts as CSV at any time. To delete your workspace, email support@hitmind.ai from the address on your account. We will revoke HitMind's access to your Google and WordPress accounts, send you a final export, and delete your workspace and all receipts within 30 days of your request. You can also revoke HitMind's Google access or disconnect a publishing destination yourself at any time in Settings → Connections. Anonymous audit reports, run without an account, are stored as snapshots so that each report has its own link: we keep the audited domain, the scores and the findings, and we do not store your IP address, browser details or email address with them. Anyone who has a report's link can open it; the link ends in a random code and is not listed publicly. These reports are not part of any workspace, so deleting a workspace does not cover them. To have one deleted, email support@hitmind.ai with its link.
Your rights and choices
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise most of these rights directly, in the product:
- Access and export — email support@hitmind.ai and we will send you an export of your workspace within 30 days. You can download your receipts as CSV from the Receipts page at any time.
- Correction — update your account details directly in Settings.
- Delete everything — email support@hitmind.ai, as described above.
- Revoke Google access — disconnect Google Search Console from Settings → Integrations, or revoke HitMind’s access at any time from your Google Account permissions page.
For anything you cannot do directly in the product, or if you have questions about this policy, contact us.
Children’s privacy
The Services are not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as the Services evolve. If we make a material change, we will post a notice on this page and, where appropriate, notify you by email. The "Last updated" date at the top always reflects the current version.
Contact us
Questions about this policy, your data, or a Google-data request? Reach us at:
- Entity: HIII PTE. LTD
- Email: support@hitmind.ai