Last updated 23 August 2026
The short version. We store your email, the sites you scan, and the text of the pages we crawl. Your AI provider keys are encrypted before they touch our database. Page text is sent to whichever AI provider you configured, because that is how relatedness and rewriting work. We do not sell anything to anyone, and we do not use your content to train models.
| Data | Why |
|---|---|
| Email address | Your account identity and sign-in |
| Password | Stored only as a salted hash. We never see the original and cannot recover it. |
| Site URLs you scan | To crawl them and to schedule re-crawls |
| Page content from those sites | Headings, body text, existing links, and word counts — needed to score relatedness and find where a link belongs |
| Link suggestions and decisions | Your approvals, rejections, and the published-link ledger |
| AI provider API keys | Encrypted at rest. See section 4. |
| Connector endpoints and tokens | So approved links can be written back to your site |
We do not use advertising trackers or third-party analytics that follow you across other sites.
When you enter a URL, we fetch its pages, strip navigation and footers, and keep the main text along with headings, existing internal links, and word counts. That extracted text is stored against your account so we can compute relatedness and show you the exact paragraph a link belongs in.
You are responsible for having the right to scan the site you enter. Scan sites you own or have permission to work on. We crawl on your instruction, as your agent.
We also cache computed embeddings so re-scans do not re-send the same text to an AI provider. That cache is discarded automatically if you change AI provider, because vectors from different providers are not comparable.
This is the disclosure that matters most, so it is stated plainly.
To compute relatedness and write rewrites, the text of your pages is sent to an AI provider. Which one depends on the keys you configure. Providers may include Google (Gemini), Groq, Cloudflare Workers AI, Mistral, OpenRouter, Hugging Face, and OpenAI.
What is sent: extracted page text, headings, and the sentence being rewritten. What is not sent: your password, your email, your other API keys, or your connector tokens.
When you use your own API keys, your relationship on that traffic is with that provider, under their terms and privacy policy. We pass the text through; we do not retain a separate copy at the provider on your behalf. If you have content you do not want leaving your infrastructure, do not scan it — the tool falls back to a local TF-IDF calculation without an AI key, and that path sends nothing anywhere.
We do not use your content to train any model, and we do not permit it to be used for that by us.
Provider keys you save in Settings are encrypted before being written to the database, using a key held in the server environment rather than in the database itself. They are shown masked in the interface and are only decrypted at the moment a request is made on your behalf.
Deleting your account deletes them. You can also clear any key from Settings at any time.
To publish approved links we need an endpoint on your site and a token. Both are stored against your account. We only ever write links you explicitly approved, and every write is recorded in your ledger with the source page, target page, and anchor text.
We block requests to private, loopback, and link-local addresses, so the scanner cannot be pointed at internal infrastructure.
Account settings has a delete option that removes your account and the data attached to it: suggestions, pages, ledger, connections, settings, and stored keys. This is not reversible.
If you would rather ask us, write to the address below and we will do it. You can also ask what we hold about you.
Passwords are salted and hashed. Provider keys are encrypted at rest. Traffic is served over HTTPS. Every query is scoped to the signed-in account, so one account cannot read another's data.
We are a small product and we are not going to claim certifications we do not hold. There is no SOC 2 report, no ISO 27001, and no contractual uptime guarantee. If your organisation requires those, we are not the right tool for you yet, and we would rather say so here than in a procurement call.
Questions, deletion requests, or anything else: hello@prakam.com.
If we change this policy materially, we will update the date at the top and tell account holders by email.