Privacy Policy — What Mentioned Stores

Who we are

Mentioned is operated by Pickleland LLC, 21427 Martin Lane, Pflugerville, TX 78660, United States (“we”, “us”). For the personal data this page describes, we are the controller under the EU and UK General Data Protection Regulation (GDPR) and similar laws. When a business uses Mentioned for its work, it is the controller of the personal data in its workspaces, such as its teammates' accounts, and we process that data on its behalf under our Data Processing Agreement. Questions about this policy or your data: support@mentioned.at.

What we collect

Check data. The brand and category you enter, the 5 generated buyer questions, the AI's answers, and your resulting score. This is what powers your results and any shareable link you create.
A hashed IP address. We hash your IP address (SHA-256) before storing it with each check, and use the hash only to enforce the limit on free checks per network and to make sure an email saved with a result comes from the person who ran that check. The per-minute burst limit is keyed on your IP address inside Cloudflare's rate limiter, not in our database. We never store your raw IP address. A hashed IP address still counts as personal data under the GDPR, and we treat it that way.
An email saved with a check result, only if you give it to us. If you leave your address alongside a check result, we store the email address you enter and, optionally, a reference to the check it relates to. Outside that, your account and the contact form, we do not collect email addresses.
What you send through the contact form. Your name, email address, the optional company field, the topic and your message are emailed to us so we can reply. They are not written to our database; the email in our inbox is the only copy we keep.
Analytics. On the public pages we use Google Tag Manager to load Google Analytics 4, which tells us which pages get visited and how people find the site. It sets first-party cookies (_ga and _ga_*) and Google receives the address of the page, the referring page, your browser and device type and an approximate location derived from your IP address, under Google's privacy policy. Cloudflare, which hosts the site, also adds Cloudflare Web Analytics to our pages, including the app; it counts page views and load times without setting cookies. Our pages load their fonts from Google Fonts, so Google also receives your IP address and browser details when a page loads. We also count two things you do: that a check finished, and that an email was saved. Those two counts carry no detail about you — the check event includes only a coarse band for the score (none, some, most or all of the 5 questions), and neither one carries your brand, your category, your email address, your result link, or any of the AI's answers. This does not affect the data described above — your checks, hashed IP, and any email are handled the same way regardless.
Where you came from, if a link told us. If you arrive through a link that carries a referral tag (for example one from a partner such as Hire Alvin, with ref or utm_ values in the address), we keep those tags and the path of the page you landed on in a first-party cookie called mnt_ref for up to 30 days. The cookie holds only those short tags, nothing about you, and your browser's scripts can't read it. Our own sign-up and “Run a free check” buttons carry a tag too, naming only where the button sits (such as nav or footer); clicking one stores that tag and the path of the page on this site you clicked it from, in the same cookie, unless a partner's tag is already there. If you create an account while it's there, we save the tags with your account so we can see which partners and which of our buttons send people to Mentioned. If you neither arrive through a tagged link nor click one of those buttons, nothing is set and nothing is saved.
Your account. Running a check needs one. We store your email address and your password — the password only ever as an argon2id hash with a random per-account salt, from which there is no path back to what you typed. Accounts created before argon2id are verified against their older PBKDF2-SHA256 hash and moved to argon2id the next time you log in. A login session is a random token in a cookie; we store only its SHA-256, so a copy of our database cannot be replayed as a login.
Signing in with Google, only if you use it. “Continue with Google” asks Google for the openid email profile scopes and nothing more. From Google's signed reply we use your verified email address, to find or create your account, and the stable ID Google gives your Google account, which we store linked to your Mentioned account with the dates it was linked and last used. We do not store your name or profile photo, and we keep no access grant from Google: this sign-in gives Mentioned no access to your Google data, and it is separate from the Analytics and Search Console connection described below. We link Google to an existing account only when both Google and Mentioned have verified the address. An account created this way has no password until you set one with a reset link.
Passkeys, only if you add one. For each passkey we store its credential ID, its public key, a signature counter, the transport hints your browser reports (such as “internal” or “usb”), the name you give it, and when it was added and last used. The private key never leaves your device or password manager, and the fingerprint, face or PIN check happens on your device: we never receive biometric data. Each sign-in or setup uses a one-time challenge that we store for at most five minutes.
Provider API keys, only the ones you deliberately save. If you save a key on the Settings page, we store it encrypted. See the section below for exactly what that protects you against, and what it does not.
A Google connection, only if you connect one. If you connect Google Analytics and Search Console, we store an encrypted Google access grant and the property and site you picked. The analytics data itself is not stored, except in an AI gap report you choose to run. See Google user data below.
A WordPress connection, only if you add one. If you connect WordPress to send fix drafts there, we store your site address, your WordPress username and an application password. The password is encrypted the same way as a saved provider key, with only its last four characters kept readable, and it is only ever used to create drafts on your site. Disconnecting deletes it.
Visits to a prospect audit, if an agency sends you one. When an agency on Mentioned shares an audit link, we count when it is opened and when its button is clicked, with the time and the host name of the page that linked to it. We do not store your IP address, a cookie or anything about your browser for this, and visits by the agency's own team are not counted.
A Bing Webmaster Tools key, only if you save one. It is encrypted the same way as a saved provider key, with only its last four characters kept readable so the page can show which key is saved. No report reads it yet. Removing it in Settings deletes it.
Apps you connect to your account. If you connect Claude or another MCP client, with an API token or by approving it on our consent screen, we store the token's SHA-256 hash rather than the token itself, the name you gave it or the app's name and return address, and when it was created (and, for a token you made, when it was last used). See Connected apps below for what such an app can do.
The free tools. The AI crawler checker, llms.txt validator and structured data checker fetch the address you enter from our server and show you what they found. We do not store the address, the page or the result. Each request counts against a short-term rate limit keyed on your IP address, held in Cloudflare's rate limiter rather than our database, and any request that fetches a page passes a Turnstile check first. Text you paste into the llms.txt validator is checked and discarded. The llms.txt generator and the buyer question generator run entirely in your browser and send nothing to us.

What we don't collect

No raw IP addresses — only the hashed form described above.
No password in a readable form — see above.
No API key from a one-off check. If you paste your own key for ChatGPT, Gemini, DeepSeek, Groq or Perplexity into the checker on the home page, it is sent with that one check, used to ask the questions, and discarded when the request ends. It is never written to our database and never written to a log, at any level, including error logs. That is unchanged. Keys you deliberately save in Settings are a separate, opt-in thing, described next.

Bring-your-own-key providers

The free check runs on Claude using our own Anthropic key, on ChatGPT through our own OpenRouter account, and on Gemini through our own OpenRouter account (or our own Google key when OpenRouter is not available). You can optionally add your own API key for another provider to compare answers. When you do:

The key travels with that single check over HTTPS, is used as an authorization header for the requests to that provider, and is discarded. We store nothing about it — not the key, not a hash of it, not a fingerprint.
If you tick “Remember these keys in this browser”, the keys are saved in your own browser's local storage on your device so you don't have to paste them each time. That is a convenience with a real tradeoff: anything running in that browser can read them. The box is off by default, and “Forget saved keys” clears them.
Your brand, category and the generated questions are sent to whichever providers you select. For a provider you supplied a key for, that request is processed under its own API terms and your own account with them. For Claude, ChatGPT and Gemini on a free check, it is processed under our accounts — see the note on Google below.

Keys you save in Settings

If you have an account, you can save a provider API key so you don't have to paste it every time. That is opt-in, it is not required for anything, and every weekly run works without it. Here is exactly what happens to a saved key:

It is encrypted (AES-256-GCM) before it is written to our database, under a key that is not stored in that database. So a copy of the database on its own contains no usable keys.
The limit of that, stated plainly: this site can decrypt what it stores, because it has to in order to use the key. So the encryption protects you if our database leaks. It does not protect you from us, and we are not going to claim otherwise. If that is not a trade you want, don't save a key — pasting one into a one-off check still works and stores nothing.
We keep the last four characters unencrypted so the page can tell you which key is saved. We never display the key again and never return it from any API.
A saved key is used for two things only: a run you explicitly start on your keys from a keyword's page, and every run of a keyword you have set to daily. Both spend your budget with that provider. A weekly run never touches it — that one is on our key, as it always was — and it is never used for anyone else's check.
OpenRouter. If you save an OpenRouter key and list models, a run on one of them sends your questions to OpenRouter, which passes them to the company behind the model you chose — OpenAI, xAI, Meta, Mistral and so on — under your OpenRouter account and its terms. The model list you save is stored as plain text; it is a list of model names, not a secret.
Removing a key on the Settings page deletes the stored row.

Google user data

Connecting Google is optional. If you do, from Settings, here is exactly what Mentioned does with the access you grant.

What we access. Two read-only Google scopes, requested together on one consent screen: https://www.googleapis.com/auth/analytics.readonly (Google Analytics 4) and https://www.googleapis.com/auth/webmasters.readonly (Google Search Console). With them we read the list of GA4 properties and Search Console sites your Google account can see, so you can pick one of each. Then, for the property and site you picked, we read the last 28 days of Search Console clicks, impressions, click-through rate, average position and top search queries (the last 90 days of queries when you open the AI gap report), and GA4 sessions and users, including sessions whose source is an AI assistant such as chatgpt.com or perplexity.ai. We cannot change anything in your Google account. These scopes are read-only.
How we use it. Only to show that data back to you, on the Search & traffic page of your own account, next to the AI-visibility figures Mentioned already tracks for you. It is fetched from Google each time you open that page and is not stored in our database. To tag queries that mention your brand, we compare the query text against the brand names you track. That is a plain text match on our server, not an AI model. The one exception is the optional AI gap report, described below.
The AI gap report (optional, and only when you run it). If you run it, you choose which of your Search Console queries to check. Only when you press the button that names the assistants is the text of each query you chose sent, exactly as written, as a question to those AI assistants (currently ChatGPT, Claude and Gemini, through our API accounts and through OpenRouter). No other Search Console data is sent to them: not clicks, impressions or positions, not your site address, and no query you did not choose. The report (the chosen queries with their Google position, clicks and impressions, and the assistants' answers) is stored so that you and the members of the workspace you ran it in can open it again. It is never published or shared outside that workspace, and it is not used for advertising or to train models. If you choose to track those queries, they become the questions of a tracked keyword and are asked again on every run until you remove it.
Not shared, sold or transferred. We do not sell Google user data, share it with or transfer it to anyone else, or use it for advertising, retargeting or any kind of profiling. Other users of Mentioned, including teammates in a shared workspace, cannot see your Google data, except an AI gap report you ran in a workspace you share with them.
Not sent to AI providers, and not used to train models. Google Analytics and Search Console data is never sent to Anthropic (Claude), Google Gemini or any other AI provider and never included in a prompt, with one exception: the query texts you choose to send when you run the AI gap report, as described above. It is never used to develop, improve or train any AI or machine-learning model, ours or anyone else's.
How it is protected. What we store is the long-lived access grant Google issues (a refresh token), plus the property ID, property name and site URL you picked. The refresh token is encrypted with AES-256-GCM before it is written to our database, under a key that is not stored in that database, and it is never shown to you or anyone else, never returned from any API and never written to a log. The limits of that encryption are the same ones described for saved API keys above. All traffic to Google and to this site uses HTTPS.
Retention and deletion. The connection is kept only until you disconnect it. Disconnect Google in Settings revokes the grant at Google and deletes the stored connection. Deleting your account does the same: it revokes the grant at Google and deletes the stored connection. You can also remove Mentioned's access at any time from your Google account at https://myaccount.google.com/permissions. After that, the report stops working and asks you to reconnect. Because the analytics data is fetched live and not stored, there is nothing else of it to delete, apart from AI gap reports. Those are deleted when you delete one, when you disconnect Google (every report you ran) and when your account is deleted.

Limited Use. Mentioned's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Connected apps

Connecting Claude or another MCP client is optional, and only you can do it. A connected app can read your account's data: tracked keywords, scores and trends, and the questions, competitors, models, sources and stored answers behind them. When you ask it to, it can also re-run a tracked keyword, which spends one run of your daily allowance, or add a keyword to track, within your plan's limits. It cannot read your password or your stored API keys. What it reads is sent to that app and the AI provider behind it, under your own agreement with them, not ours. You can revoke a token or disconnect an app at any time under Connect Claude in Settings, and it stops working immediately.

Who else sees this data

Running a check requires sending your brand, category, and generated questions to Anthropic (the maker of Claude) and to Google (the maker of Gemini) to get the AI's answers — that's the core of the product. Our Claude and Gemini requests may be routed through OpenRouter, which forwards them to Anthropic or Google and passes the answer back; the free check also asks OpenAI (the maker of ChatGPT), through OpenRouter in the same way. Each processes that request under its own API terms. The site itself runs on Cloudflare (Workers, D1 database, and Turnstile for bot protection), which processes traffic and stores data on our behalf as our infrastructure provider. Messages from the contact form, and account emails such as password resets, are delivered by Resend, which handles them only to send them.

If you subscribe to a paid plan, Stripe processes the payment. Your card details go to Stripe directly and never reach our servers — we store only the customer and subscription identifiers Stripe gives us back, which is what tells the app which plan you are on. We cannot see your card number, and we never charge a free account.

The one case where Google may learn from what you send. Our Gemini requests go through OpenRouter, under OpenRouter's agreement with Google. If we ever stop using OpenRouter, Gemini falls back to our own Google API key, which is on Google's free tier, and Google states that content submitted on that tier is used to improve their products. Anthropic's API terms do not do this. If that matters to you, add your own Gemini API key in Settings — a check on your key runs under your account and your terms with Google, not ours.

We don't sell data, and we don't share it with anyone else for advertising or marketing purposes.

The full list of companies that process personal data for us, with what each one receives and where, is on our sub-processors page.

Why we use your data

Where the GDPR applies, these are our legal bases:

To provide Mentioned under our terms (contract): your account and sign-in, the checks and tracked keywords you run and their results, shared result links, workspaces and invitations, the keys and connections you add, the emails the service sends you, and billing if you upgrade.
With your consent: Google Analytics and the mnt_ref cookie, where the law requires consent. You can withdraw it at any time in Cookie settings.
Our legitimate interests in keeping Mentioned secure, affordable to run and improving: the hashed IP address, rate limits and the Turnstile bot check, short-lived request logs, replying to what you send through the contact form, recording which partner or button brought a new account, serving the site and its fonts, and, outside the regions where we ask first, website analytics. You can object to any of these at any time.
Legal obligations: keeping billing records for as long as tax law requires.

Where your data is stored

Your account and everything in it are stored in Cloudflare's D1 database in the United States (Western North America). Pages are served from the Cloudflare data center nearest you, and the companies on our sub-processors page process data in the United States. So if you use Mentioned from the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred to the United States and processed there. Transfers to the companies that process personal data for us rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard. For businesses, our Data Processing Agreement includes the Standard Contractual Clauses, with the UK Addendum and the Swiss amendments.

Why we store check results at all

Storing each check is what makes the "Copy verdict" / "Share on X" links and the /r/<id> results page work — if we didn't keep the record, a shared link would have nothing to load. It also lets us enforce fair-use limits.

How long we keep it

Your account and what is in it: for as long as you have the account, including your checks and their hashed IP addresses, tracked keywords and their run history. Deleting your account deletes them straight away, as described under Your rights and choices.
Inactive accounts: an account nobody has used for 2 years is deleted along with everything in it, exactly as if you had deleted it yourself. Using it means signing in, opening the app, or using an API token or a connected app. We email you 30 days before, naming the date, and using the account at any point before then keeps it. We only delete an account after that email has gone out. Accounts on a paid plan that can still renew, and accounts that own a shared workspace its members are still using, are not deleted for inactivity.
Checks from before accounts existed: a few checks were run without an account in July 2026. We keep them, with their hashed IP addresses, so their shared links keep working. Ask us and we will delete one.
Sign-in sessions: 30 days. Password reset links last 1 hour, email verification links 7 days, workspace invitations 7 days by default and never more than 30, and passkey and sign-in step challenges a few minutes.
Contact form messages: in our inbox, for as long as we need them to answer you and follow up. Ask us and we will delete yours.
Database backups: Cloudflare's point-in-time recovery for our database keeps no more than 30 days, so anything deleted is gone from backups within 30 days.
Request logs kept by Cloudflare: up to 7 days.
Google Analytics data: for the retention period set in our Google Analytics property.
Billing records: kept by Stripe for as long as tax law requires. When an account is deleted we keep only a record that Stripe sent us a billing event, with the account identifier removed.

Cookies and similar technologies

Most of the cookies we use are needed for the site to work or remember a choice you made, so they are always on: the sign-in session cookie, the short-lived cookies that carry a sign-in, passkey or connection attempt between steps, mnt_consent, which holds your cookie choice, and the preference cookies below. Two things are not needed, so they follow your choice: Google Analytics' cookies and mnt_ref.

Asking before analytics. If you visit from the European Union, the rest of the European Economic Area, the United Kingdom or Switzerland, or we can't tell where you are, Google Analytics and the mnt_ref cookie stay off until you choose Accept on the cookie banner. Elsewhere they run as described above unless you choose Decline. Declining, or changing your mind later, deletes the _ga cookies and stops mnt_ref being set. We remember your answer for six months in a cookie called mnt_consent. You can change it at any time in Cookie settings.
Preference cookies. mnt_lang remembers the language you picked for a year. mnt_theme remembers light or dark for a year, and the site's own scripts read it so every page opens in the theme you chose. mnt_rail remembers whether you collapsed the app's sidebar, and mnt_ws which workspace you last opened. Short-lived cookies also carry a sign-in or connection attempt between steps and expire within minutes. None of these is used for advertising or tracking.
Keys in your browser, only if you ask. Ticking “Remember these keys in this browser” on the checker keeps your provider keys in your browser's local storage, as described under Bring-your-own-key providers. Nothing else we run stores anything in local storage.

Your rights and choices

Running a check needs a free account, so we hold the email address you sign up with, and whichever ways you sign in: a password we only ever store as an argon2id hash (older PBKDF2 hashes are replaced at your next login), a link to your Google account, and any passkeys you add. You can remove a passkey from the Security page at any time.

You can delete your account yourself, from Settings. It removes your account, every tracked query and its run history, every check you have run, any saved provider keys, your Google and Bing connections, your Google sign-in link and passkeys, your API tokens and connected apps. Shared result links stop working, because the answers behind them are part of what gets deleted. If you have a paid plan it is cancelled with Stripe first, and if that cancellation fails nothing is deleted — we will not leave you being charged for an account you can no longer log into. We keep one thing: a record that Stripe sent us a billing event, with your account identifier removed from it.

If you only want an email address removed, or a single shared result taken down without deleting the account, send us a message through the contact form and we'll handle it.

You can download each tracked keyword's run history as a CSV from the dashboard, change your cookie choice at any time in Cookie settings, and disconnect Google, revoke an API token or a connected app, or remove a saved key in Settings.

If the GDPR or a similar law applies to you, you also have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy in a portable format, to restrict or object to how we use it, and to withdraw your consent at any time without affecting what happened before. To use any of these rights, email support@mentioned.at. We answer within one month. You can also complain to the data protection authority where you live or work.

If your workspace belongs to a business, requests about the data in it may be better made to that business, which controls it. We will pass on any we receive.

Changes to this policy

If what we store changes, this page will be updated first, and the "last updated" date at the top will reflect it.

Run a free check