Privacy policy

What ContextBolt is

ContextBolt builds tools that plug your own data into the AI assistants you already use. Two of them are live today, and they are separate products with separate accounts.

• ContextBolt Bookmarks: a Chrome extension that saves posts and web pages, with an optional endpoint so your AI tools can search what you saved.
• ContextBolt SEO: a paid MCP server that answers SEO questions inside your agent, with an optional Google Search Console connection and a web dashboard.

This policy covers both products and the contextbolt.com website. Every section below says which one it applies to. The two products run on separate databases, so your bookmarks are never visible to the SEO tool and your SEO data is never visible to the extension.

The short version

• We never sell your data, and we run no advertising pixels.
• We never use your content to train AI models.
• We measure how the website is used, and we tell you exactly how below.
• You can ask us to delete everything we hold, and we do it within 7 days.

The rest of this page is the detail behind those four lines, product by product.

Bookmarks: what the extension keeps

Everything you save lands on your own machine first, in your browser's IndexedDB. That covers the post or page text, the AI-generated tags, the topic it was filed under, and the search index. Nothing else leaves your device except the parts described below.

Bookmarks: how the extension reads a page

ContextBolt saves from four places, and each one works differently.

• X/Twitter: two ways. When you open your bookmarks page, the extension reads the bookmarks response the site already sent your browser. And when you press X's own bookmark button on a post anywhere on the site, it reads that post there and then. Either way it keeps the post text, the author and the metadata.
• Reddit: Reddit has no save button we can add, so the extension syncs your saved posts for you. While you are signed in and browsing any Reddit page, it asks Reddit for your saved list using the session you are already signed in with, and reads up to 3,000 of them. When that works it waits five minutes before checking again. When it fails, or when you have nothing saved, it may check again on the next Reddit page you open. It does not wait for you to open your saved page, and it reads nothing else you browse.
• LinkedIn: the extension adds a save button to feed posts. Only posts you press save on are captured.
• Any other web page: when you click the ContextBolt icon and press Save this page, the extension reads the open tab once and keeps the title, the URL, the author if the page names one, and up to 10,000 characters of the main text. Highlight a passage first and it saves your highlight instead of the article, as long as the highlight runs to more than about forty characters.

That last one is worth being precise about. The extension has no standing permission for the sites you browse. It uses activeTab and scripting, which means it can read the tab you are looking at, only at the moment you click the icon, and only that once. It is not watching your browsing in the background. Its standing site permissions are X, Reddit, LinkedIn and our own API, and nothing else.

The extension never touches your passwords, your direct messages, your private content, or anything beyond the posts and pages you choose to save.

Bookmarks: what goes to our servers

When a bookmark is processed, its text is sent to our API at api.contextbolt.app for three jobs.

• Tagging and topics using OpenAI's gpt-5.4-nano. Each bookmark comes back with 2 to 4 descriptive tags and a topic. If that call fails, the same request is retried with Anthropic's Claude Haiku, so your text can reach either company.
• Embeddings using OpenAI's text-embedding-3-small. These power related-bookmark suggestions in the extension, and search by meaning through the Pro endpoint.
• Naming your topics using the same OpenAI model as the tagging. Once your library is big enough to group, the author and the first 200 characters of up to five bookmarks from a group are sent so the group can be given a name and a description.

We do not keep the text after that. It is processed in memory and dropped once the answer goes back to your browser. Storing your library on our servers is a separate thing, and that is cloud sync below.

Two smaller things come out of that processing and are worth naming. We log one row per AI call with your account ID, which model ran, how many tokens it used and when, so we can watch what the AI is costing us. And the tags and topics that come back are cached for an hour against your account ID, so a retry does not pay for the same work twice. Neither holds the text of a bookmark.

The extension also tells us when you reach a handful of first-time milestones. Your first save, your first sync, the first time you hit the Basic limit, and whether you came back after a week. Each one is a milestone name, a timestamp and sometimes a count. None of them carries a bookmark. It is how we tell whether the product is any good at getting people started, and it happens on the free tier too.

Bookmarks: your account

Installing the extension creates an anonymous account so we can manage API access and rate limits. You can use Basic without a card. If you sign in during onboarding or in Settings, we store your email and its verification status so you can return to the same account. Signing in uses a short-lived email code, not a password.

Upgrading to Pro means giving us an email address and activating a license key. We store the email, the billing email Lemon Squeezy gives us if it differs, the license key and your API tokens. If you cancel and type a reason into the box, we keep that too, against your account. We use the email for account management, license checks and product emails you can unsubscribe from. We never sell it and never pass it to anyone outside the services listed further down this page.

Bookmarks: cloud sync (Pro only)

Pro syncs your library so the MCP endpoint can reach it. When it does, this is what sits in our Cloudflare database.

• Two copies of each bookmark saved by the extension. One is the raw capture, exactly as the extension read it, which is the platform's own response on an X or Reddit sync and the details taken off the page for a LinkedIn post or a saved web page. It is kept so a library can be rebuilt if something goes wrong. The other holds the title, author, text, URL and tags, and is the one the endpoint reads to answer your AI tool. A bookmark your AI tool adds through the endpoint has only that second copy. Saved web pages are stored at up to 2,000 characters, not the 10,000 the extension keeps on your machine.
• Embedding vectors, held in Cloudflare Vectorize. They are what makes search by meaning work.
• Topic cluster names, descriptions and counts.
• A record of each call your AI tool makes to the endpoint. The tool name, a short summary of the arguments, whether it worked, and how long it took. We use these to find broken tools, not to read your library.

We can read both of those copies, and you should assume we can. They sit on encrypted disks at Cloudflare, the same as everything else we store there, but that is storage security and not end-to-end encryption. There is no key that only you hold. Treat cloud sync as content we hold rather than content only you can open. Sync comes with Pro and runs on its own. If you would rather we did not hold your library, Basic keeps it on your machine. Text still passes through us for the three jobs above, and is never stored. The one exception is a bulk import on Basic. If a sync brings in more than your visible 150 at once, the overflow is parked on your machine unprocessed and its text is never sent. Anything you save one at a time does go through, because a new save is always the most recent.

Bookmarks: the MCP endpoint (Pro only)

Pro lets you connect an AI app using OAuth at https://api.contextbolt.app/mcp. You sign in with your account email, enter an email code, and approve access. Your existing personal URL with a token in its path also remains available for compatible clients. Either connection can search your synced bookmarks, export them, and add new ones. It cannot edit or delete what is already there.

The shared OAuth URL is not a secret. Your personal token URL is: anyone holding that one can read your library, so treat it like a password. Regenerating it from the extension invalidates old personal URLs. OAuth connections use separate credentials and should be disconnected from the AI app when no longer needed.

ContextBolt SEO: what we store

ContextBolt SEO is a paid subscription, so the product itself has no free tier. Subscribing creates an account holding your email, a private personal MCP token for compatibility, and your Lemon Squeezy subscription and customer IDs. The two free tools on the website run without an account and are covered in their own section below.

Using the tool then builds up a record of your own research. That record is the product rather than a side effect of it, which is why it is kept.

• Your lookups: the keywords, domains and URLs you ask about, a short summary of each answer, and how often you have asked. This is what lets your agent remember what you looked at last month and tell you what has moved since.
• Site audits: the URLs, titles, descriptions and issues found on any domain you audit.
• Usage records: one row per tool call with the tool name, a short summary of the arguments, whether it worked, how long it took, what the data cost us, and which AI app made the call. These run your credit balance and show us when a tool breaks.
• Credit ledger: every credit granted and spent.
• Visibility reports: if you run the full AI visibility report, the whole report is saved against your account so your board can show it again without spending another credit. Those are kept until you ask us to remove them.

ContextBolt SEO no longer writes research to your own machine. Earlier versions mirrored findings into a ./seo-findings/ folder in your project. Any files already written are yours. They never come back to us and we cannot see them.

Both products: sign-in and OAuth connections

We use your email to send sign-in codes through Brevo. Codes expire after 10 minutes. We store a hash of each code, the account or email it belongs to, its expiry and attempt count, and short-lived request limits based on your email and IP. The browser sign-in flow also uses an essential cookie to bind the request to the browser that started it and protect against forged requests.

When you approve an AI app, we store its registration, the permission grant and token records in Cloudflare. The app receives credentials for that product account, not your email code or legacy personal token. Access tokens last one hour; refresh tokens allow the app to renew access for up to 30 days. The connection remains subject to your current plan. Disconnect it from the AI app when no longer needed. Disconnecting does not cancel billing or delete your stored data.

The AI app receives the data returned by the tools you let it use, under that app's own privacy policy. Bookmarks and SEO have separate account and permission records. SEO's shared connection URL is https://seo.contextbolt.app/mcp. Your private SEO Board link and any personal token URL remain secret links; the shared OAuth URLs are not secret.

ContextBolt SEO: Google Search Console

ContextBolt SEO can connect to your own Google Search Console so your AI agent can read your real search data. Connecting is optional and is never required to use the product.

• What we access: read-only, through the webmasters.readonly scope. That covers your search performance (clicks, impressions, click-through rate, average position, and the queries and pages behind them) and whether your pages are indexed. We never request write access and cannot change anything in your Search Console.
• How we use it: only to answer your SEO questions inside your own AI agent, and to draw your dashboard. We do not sell it, we do not share it, we do not use it for advertising, and we do not use it to train machine learning or AI models.
• How we store the connection: one encrypted credential, your Google refresh token, encrypted at rest. Short-lived access tokens live in temporary cache with an expiry and are never written to our database.
• How we store the results: when you ask a question, the answer is fetched live and is not kept. Your dashboard is the exception, in two ways. A nightly job saves a small snapshot of your top queries and headline numbers so the board loads instantly instead of re-querying Google, and those snapshots are deleted automatically after 14 days. Separately, any query you pin to your board is copied onto your account with its clicks, impressions, click-through rate and position, and refreshed nightly. A pinned query stays there until you unpin it.
• Your control: disconnect at any time by asking your agent to disconnect, or by removing ContextBolt SEO at your Google account permissions. Disconnecting deletes the stored credential immediately and stops anything new being fetched. Do it before you cancel if you want to do it yourself, because disconnecting runs through the MCP endpoint and the endpoint stops answering when a subscription ends. After that, email us and we delete the credential within 7 days. Revoking us at Google stops us using it either way, but it does not remove our copy. Snapshots age out within 14 days. Queries you pinned stay on your account until you unpin them or ask us to clear them.

ContextBolt's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

ContextBolt SEO: your dashboard

Your board lives at a secret URL with a random slug in it, separate from your MCP token so the two can be revoked independently. Anyone holding that URL can see your board, so treat it the same way you treat the endpoint. If you need to cut off the old one, regenerate the link from the footer of the board itself.

The free tools on the website

Three things on contextbolt.com work without an account, and they hold different things from the products above.

• The Zero-Click Report: connects to your own Google Search Console to build a one-off report. It asks for one-time access rather than lasting access, so we never receive anything that would let us come back later, and there is no stored credential to leak or revoke. The access token sits in temporary storage for up to 10 minutes while you choose a property, and the finished report for up to 30 minutes. After that both are gone. The Google Limited Use commitment above covers this too.
• The AI Visibility Checker: you give it your brand or your domain, and a category if you want to narrow it, and it runs a free check. To get the full report you give an email address, and we email it to you. The brand and the category go to DataForSEO, who run the check for us. A domain is reduced to the brand name in it before anything is sent. We keep what you typed, the result and that email address, so the free check cannot be run over and over by the same person, and the record is kept against a one-way hash of your IP address rather than the address itself. There is no expiry on it. The email also goes to Brevo. Ask us and we delete the lot.
• The keyword box in the free guides: four of the guides let you check a keyword without signing up for anything. The keyword you type goes to DataForSEO to be looked up, and the answer is cached for a while so the next person asking the same thing costs nothing. We do not store who asked.

Payments (both products)

Lemon Squeezy handles payment and is the merchant of record. We do not store card numbers, bank details or any payment credential. All of it is handled by their PCI-compliant infrastructure. See Lemon Squeezy's privacy policy.

Cookies and analytics (the website)

We measure how contextbolt.com is used, so we know which pages are worth writing and which ones are wasting your time. Two things do that, and both run on the website only. Neither runs inside the extension, and neither can see your bookmarks or your SEO data.

• Google Analytics 4: the standard install. It sets its own cookies and records page views and clicks on our buttons. It is subject to Google's privacy policy.
• Our own counter: a small script that sends the page you are on, the page you came from, any campaign tags in the URL, your rough location, whether you are on a phone or a desktop, which of our buttons you click, and which links you follow off the site, to our own server. Rough location means the country, region and city your internet connection resolves to, which our host works out for us, and the coordinates of that place. It is the city, not your address, and it is often wrong by miles.
• What the counter uses to recognize you: a random ID stored in your browser, so a second visit is not counted as a second person. It is a random string, not your name and not your email. We do not store your IP address alongside it. Your IP is checked once, against a short list of browsers we leave out of our own numbers, and then it is not written down.

One thing the counter does that is worth spelling out. When you click through to checkout, that random ID travels with the order, so we can see which pages actually lead to a sale. If you buy, our analytics database ends up holding the ID, a one-way hash of your email address, and the order. That links the pages you read before buying to your purchase. We use it to work out which pages are worth writing and nothing else. The order record Lemon Squeezy sends us does carry your name and email, and it is deleted after 30 days.

All of this is used to understand traffic. We run no advertising pixels and we sell none of it. Google Analytics is Google's product, so what Google does with its half is governed by their terms rather than ours, and your Google ad settings are where you control that side of it.

Opting out: the counter honors a switch you set yourself. Open the browser console on contextbolt.com and run localStorage.setItem('cb_ignore', '1'), and that browser stops sending anything. For Google Analytics, a tracker blocker or your browser's own protection will stop it, and we do not work around either.

The website's email forms

Some pages on contextbolt.com ask for your email address. The free guides do, and so do the two quizzes. If you hand it over, we store your email, the page you were on, the site you came from, the campaign tags in the link you followed, your quiz score if you took one, and your IP address. Everything except the IP address also goes to Brevo, so we can send you the thing you asked for.

The IP address is there to stop the form being abused. Email us and the whole record goes.

Where we hold IP addresses

Our counter does not store one, but three other things do, so it is worth listing them in one place rather than leaving you to find them.

• The website's email forms: stored in plain, as described above.
• Bookmarks license checks: the extension checks in with us whenever its background worker starts, which in practice is every few minutes while your browser is open, and each check writes a row holding your account ID, the time, and your IP address. That adds up to hundreds of rows a day. It happens on the free tier too. We keep those rows.
• Rate limiting: both products count requests per IP address to stop abuse. Those counters live in temporary storage and clear themselves within the hour.

The AI Visibility Checker is the exception that goes the other way. It identifies you by a one-way hash of your IP rather than the address itself.

Third-party services

These are the companies that touch your data, and what each one sees.

• Cloudflare: hosting for the website, the APIs, the databases and the search index on both products. Subject to Cloudflare's privacy policy.
• OpenAI: Bookmarks. Your bookmark text goes to them for all three jobs, the tags and topic, the embeddings, and naming your topic groups, under OpenAI's privacy policy.
• Anthropic: Bookmarks, as the standby. If a tagging request to OpenAI fails, that request is retried with Claude Haiku, under Anthropic's privacy policy.
• DataForSEO: ContextBolt SEO, and the free tools on the website. The keywords, domains and URLs you ask about are sent to them to fetch the ranking, keyword, backlink and audit data you asked for, and anything you type into the free checker or a guide's keyword box goes the same way. They never see your email or your Search Console data.
• The AI assistants: ContextBolt SEO only, and only on the tools that put a question to an assistant and read the answer back. Ask one of them a question and it goes to ChatGPT, unless you name Claude, Gemini or Perplexity instead. Run the full visibility report and one live question goes to each of Perplexity, Claude and Gemini. The tools that only count mentions ask nobody anything; they read an index DataForSEO already holds. All of it goes through DataForSEO rather than direct.
• Google: three separate things. Our typefaces are served from Google Fonts, so opening any page on contextbolt.com asks Google for the stylesheet and the font files, and that request carries your IP address and which page you are on. It happens before anything else on the page and a tracker blocker does not stop it. Google Analytics is the second, as described above. Google Search Console is the third, ContextBolt SEO only, read-only, optional, and yours to disconnect.
• Brevo: both products, and the website. It holds your email address, which tier you are on, and where you are in the trial or renewal cycle. If you came in through a form on the website, it also holds where you came from, the campaign tags and your quiz score. Our emails are sent through it, so anything inside one of them passes through Brevo. On ContextBolt SEO that includes your personal MCP URL and your dashboard link, which the trial and welcome emails contain so you can set the product up.
• Lemon Squeezy: both products. Payment processing and license management.

Data retention

Bookmarks: the copy in your browser stays until you clear it or uninstall. The synced cloud copy stays while your account exists. If you cancel Pro, sync and the endpoint stop working, and the synced copy stays on our servers until you ask us to delete it.

ContextBolt SEO: lookups you have not pinned and have only asked once or twice are deleted automatically after 60 days. Anything you pin or come back to is kept until you ask us to remove it. Unpinning does not delete it. Dashboard snapshots are deleted after 14 days. Saved visibility reports and pinned queries have no expiry. If you cancel, the rest stays until you ask us to remove it.

Both: ask us to delete your account and everything we hold for it goes.

Data deletion

The extension's Clear all data button in Settings wipes the copy in your browser. Bookmarks, tags, topics, the search index, all of it. It does not reach the synced cloud copy.

To delete the cloud copy, your SEO history, or an account on either product, email [email protected]. We do it by hand within 7 days and reply to confirm it is done.

Your rights

Under UK data protection law you have the right to access, correct or delete any personal data we hold about you. You also have the right to data portability and to object to processing. To use any of them, email [email protected].

Changes to this policy

We may update this policy as the products change. Material changes go out by email if you have an account with us, or through the extension. The "Last updated" date at the top of this page always reflects the most recent revision.

Contact

Questions about privacy? Email [email protected].