Privacy Policy

Citation Rocket is operated by Citation Rocket Ltd ("we", "us", "our"). Our registered address and data-controller contact is privacy@citationrocket.com. This policy applies to the Citation Rocket web application at app.citationrocket.com, the marketing website at citationrocket.com, and the Citation Rocket Chrome Extension.

Account data: Email address and password hash when you create an account. We do not store plain-text passwords.

Audit data: The URLs you submit for auditing. We store audit results (scores, topics, playbook) in your account.

Payment data: Billing is handled by Dodo Payments. We store only a Dodo Payments customer ID and subscription status — we never see or store your card number.

Usage data: Pages visited, features used, and error logs collected via server-side logging. We do not use third-party analytics cookies.

Chrome Extension — scan data: When you activate the Citation Rocket Chrome Extension on a web page, the extension reads the page's HTML content, meta tags, structured-data scripts, and robots.txt to perform a local AEO audit. This page content is transmitted to our servers at app.citationrocket.com solely to generate your audit score. We do not retain page content beyond the duration of the request. The extension requires broad host permissions (<all_urls>) because it must be able to run on any website the user chooses to audit.

The Citation Rocket Chrome Extension requests access to all websites you visit (<all_urls>). This permission exists for one reason: so you can audit any website — yours or a competitor's — simply by clicking the extension icon while on that page. The extension does not run passively on every page you visit. It only activates when you explicitly click the extension icon.

Specifically, the extension reads: page HTML, title and meta description, <script type="application/ld+json"> blocks, the existence of /llms.txt and /robots.txt, and internal link structure. This data is sent over HTTPS to app.citationrocket.com to compute an AEO score. No data is sold, shared with advertisers, or used for any purpose other than generating your audit result.

We comply with the Chrome Web Store Developer Program Policies. We do not use the broad host permission for advertising, tracking, or any purpose unrelated to the core scan functionality.

We use your data to: deliver audits and generate your AI Readiness Score; provide Citation Snapshot results via the Perplexity Sonar API; generate and store your AEO Pack ZIP; send citation monitoring alerts you have opted into; and respond to support requests.

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

Perplexity: When running a Citation Snapshot, your domain name is included in prompts sent to the Perplexity Sonar API to retrieve live AI citation data. Perplexity's privacy policy applies to this usage.

Dodo Payments: Payment processing. Your email is shared with Dodo Payments to create a customer record.

Hosting: Our infrastructure runs on Vercel and Neon. Both are GDPR-compliant.

We may disclose data if required by law, court order, or to protect the rights and safety of our users.

We retain your account data and audit history for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes.

Chrome Extension scan data (page content sent for scoring) is processed in memory and not stored beyond the life of the request.

You have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; object to or restrict processing; and request a portable copy of your data.

To exercise any of these rights, email us at privacy@citationrocket.com. We will respond within 30 days.

California residents: we do not sell personal information as defined under the CCPA.

We use a single session cookie to keep you logged in. We do not use advertising cookies, fingerprinting, or third-party tracking pixels. The Chrome Extension does not set cookies.

All data is transmitted over TLS (HTTPS). Passwords are hashed with bcrypt. Access to production data is restricted to authorised personnel only.

Citation Rocket is not directed at children under 16. We do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes will be notified by email to active users at least 7 days before they take effect. Continued use of the service after that date constitutes acceptance of the revised policy.

Questions about this policy: privacy@citationrocket.com