Privacy

SellSniper can keep up to 12 project workspaces in this browser profile. The selected project uses local storage. Inactive project snapshots use IndexedDB and contain only SellSniper-owned Company, campaign, evidence timeline, draft, history, and non-secret receipt records.

Switching projects saves the selected workspace and restores the target. Provider credentials, authorization cookies, passkeys, session keys, analytics identifiers, and unrelated browser storage are not copied into a project snapshot. Provider authorization remains scoped to the browser.

Account upload explicitly saves all browser projects in one encrypted cloud bundle, with a combined 3 MB limit. Account restore replaces matching project IDs and preserves other local projects. Company evidence export still applies only to the active project. Older single-project cloud saves remain readable. Removing a project deletes its local IndexedDB snapshot from this browser.

SellSniper passkey accounts store a display name, preferred language, WebAuthn public key and replay counter, opaque session-token hash, and account timestamps. SellSniper does not store a password or require an email address for this account.

If you approve direct video generation, the video prompt and any optional first-frame image are sent to Google Veo. Your account retains daily start counts and operation metadata, including model, aspect ratio, provider operation identifier, status and access deadline. If you select a saved project, its identifier is retained with the start request and operation; existing unassigned records are not assigned automatically. Account video history can recover existing operations while their original access remains valid; SellSniper does not permanently archive the video files.

To prevent duplicate paid starts after interrupted requests, we retain an account-bound request identifier, a hash of the generation inputs and any confirmed operation metadata until account deletion. The reservation does not store the prompt or image bytes. Unresolved reservations do not expire into permission to generate another clip. Your browser tab retains the request identifier and an input hash in session storage until it receives the clip receipt. Deleting SellSniper account data does not delete data already processed by Google.

Upload and Restore are always founder-started. The upload contract accepts only SellSniper-owned browser records and excludes Google, GitHub, and WordPress, Webflow, Framer, or Wix credentials, cookies, passkeys, product-analytics identifiers, and unrelated site storage. A revision check stops a stale browser from silently replacing newer cloud data.

The workspace can include Company strategy, campaigns, private notes, bounded action-coach history, campaign-advisor history, creator records, the dated evidence timeline, imported evidence, repository snapshots, website field drafts, and non-secret WordPress, Webflow, Framer, and Wix draft receipts. It is encrypted with AES-256-GCM before database storage. This is server-managed encryption, not end-to-end encryption, because the service holds the encryption key needed to restore the workspace after passkey authentication.

Signing out removes the current server session but leaves browser records in place. Deleting the account removes its passkeys, sessions, encrypted cloud workspace, schedules, receipts, project viewer links, teammate access, and internal teammate reviews. Browser records remain until you remove them locally.

A signed-in founder can create a bearer link that shows a time-limited, read-only projection of one browser-local project. The projection can include selected Company strategy fields, campaign summaries, reviewed action drafts, safety checks, public destination URLs, workflow status, and numeric outcomes.

The link token is random and shown only when the link is created. SellSniper stores its SHA-256 digest, not the reusable token. The projected snapshot is encrypted with AES-256-GCM in server storage. The founder can refresh the same link from the matching browser project or revoke it before its one-day, seven-day, or thirty-day expiry.

Viewer links exclude provider credentials, cookies, passkeys, analytics property identifiers, raw private repository context, private action-coach and campaign-advisor history, founder-only outcome notes, website implementation drafts, and every mutation control. A viewer cannot approve, edit, post, publish, connect an account, or run an external action.

Anyone with an active bearer link can read its projected snapshot. SellSniper records a bounded view count and the latest view time for the founder. Revocation and expiry stop later reads, and account deletion removes every owned viewer link.

A signed-in founder can create a seven-day teammate invitation for one browser-local project. The founder copies and delivers the bearer link manually. SellSniper does not email, message, or contact the teammate. The teammate does not need a SellSniper account and accepts the invitation with a display name.

SellSniper stores only the SHA-256 digest of the random invitation token. The same strict project projection used for read-only sharing is encrypted with AES-256-GCM and bound to the owner and access record. A pending invite reveals only invitation metadata. After acceptance, anyone with the active bearer link can use that teammate identity until the founder revokes access.

An accepted teammate can read projected Company strategy, bounded evidence signals and analytics, campaign actions, drafts, and prior internal reviews. They can run a private, bounded AI CMO analysis for one projected campaign and leave internal action-review decisions and notes. The AI request is processed by the configured model provider and excludes credentials, raw provider identifiers, founder-only notes, private advisor history, and unrelated projects.

Teammates cannot change Company memory, account settings, billing, integrations, project membership, or external platforms. They cannot post, publish, send, contact, approve an external action, or change the founder's campaign state. The founder can refresh only the same project snapshot and can revoke access immediately. SellSniper retains the display name and bounded internal review events until access or the owner account is deleted.

A signed-in founder can create a daily or weekly scan schedule. SellSniper encrypts the target URL, the Company strategy captured for that schedule, any optional conversation-watch query, opt-in AI visibility questions, selected answer providers and tracked comparison names, or competitor targets with the account data key. The service retains scheduling metadata such as cadence, next and last run times, enabled state, rolling 30-day limit, locks, and private run receipts so due work can be claimed and audited.

A later Company strategy is used only after you explicitly upload the Account workspace and only when its website origin matches the scheduled target. Missed occurrences are collapsed into one scan instead of a catch-up burst, and an active scan is not overlapped.

When conversation watch is enabled, each run sends the query to Firecrawl for bounded public discovery and checks at most one Reddit thread and one Hacker News item from the last 30 days through their official read-only sources. Previously reviewed conversation URLs in an explicitly uploaded Account workspace are used as exclusions. A result replaces only its matching specialist action after exact verification; a failed or empty check leaves the general specialist action in place with a warning.

A schedule can also refresh its public website diagnostic, public HTML and CSS brand profile, and public links and mentions. The selected refresh flags are stored inside the encrypted schedule configuration. Website and brand checks read bounded public resources. Link and mention refresh uses Firecrawl search and exact-page requests, consumes provider credits, and is off by default. Successful checks replace only their compact dated summaries. A failed check keeps the previous summary and adds a bounded warning so it does not block the private scan.

AI visibility refresh is off by default. When you enable it, each run sends one to three encrypted non-branded buyer questions to each provider you select, currently Perplexity Sonar, Google Gemini with Search, OpenAI web search, or Anthropic Claude web search, without the target Company name or domain. The schedule retains only the compact dated mention, same-site citation, citation-host, and bounded tracked-brand summaries, not detailed answers. Citation hosts and sample URLs come only from URLs returned by the selected providers. They are not enriched into contacts or outreach targets. Comparison names are matched locally after provider answers return and are not added to provider prompts. A failed check keeps the prior summary and records a receipt warning.

Competitor refresh is off by default. When you enable it, each run sends up to four encrypted exact competitor names or public URLs to Firecrawl for search discovery and verified public-page reads. Only bounded cited context enters the private scan. A failed or mismatched check keeps the prior context, and the saved Company workspace is not changed automatically.

The scheduled public-page snapshot and bounded Company summary are processed by the configured AI provider. Completed results remain private until you choose Review run. That choice imports the report into the browser review workflow and records verified conversation URLs in browser discovery memory. Hacker News remains founder-authored with no generated reply. Review run does not approve, post, publish, or contact anyone.

Deleting a recurring scan removes its server-side schedule and receipts. Deleting the account removes all of its schedules and receipts through the same cascading account deletion.

When you explicitly run a market search sample, SellSniper sends one to five exact non-branded queries, a two-letter country code, an optional location, and the selected public Company and competitor websites to Firecrawl. It asks for up to ten web results per query. One provider request is made per query and can consume Firecrawl credits.

Exact returned URLs, provider request identifiers, reported credit usage, and derived tracked-site observations are stored in your browser. A compact summary containing the queries, tracked public sites, counts, sample URLs, market, and interpretation boundary can enter later scans, prompts, reports, Markdown files, Company backups, project workspaces, and evidence history when you use those features. Read-only project and teammate views receive only bounded counts and relative observations, not the exact query list or result URLs.

When you explicitly enable recurring market search in Account, SellSniper copies only the exact reviewed Company scope into the encrypted schedule: country, optional location, one to five queries, and selected public competitor sites. Each private run makes one Firecrawl search per saved query. A successful run retains only the new compact summary in its private report. A failed refresh keeps the prior summary and records a warning. Versions 1 through 11 migrate with this option disabled.

SellSniper treats the result index only as the order returned by that Firecrawl request. It does not represent the sample as a canonical Google rank, complete competitor share of voice, demand, traffic, market share, or proof of absence. Returned domains are not enriched into contacts, leads, or outreach targets, and this workflow does not post, publish, message, or contact anyone.

If you connect Google, SellSniper requests Google Search Console read-only and Google Analytics read-only access. It uses that access only to list properties you can read and to fetch the Search Console or GA4 report you explicitly select for the date range you choose. SellSniper cannot change a Google property.

A Company connection stores the encrypted Google refresh token in an HttpOnly cookie scoped to the Google API routes for at most 30 days. A separately initiated Account connection stores it as an encrypted, passkey-account-bound server record so an enabled recurring scan can refresh read-only evidence. These two connection stores are not copied into each other. Access tokens are short lived and transient. Tokens never enter browser JavaScript, local storage, reports, share links, prompts, Markdown files, or product analytics.

Detailed synced rows are stored in your browser. A bounded summary can be included in a later scan, AI prompt, report, share link, Company backup, or Markdown download when you use those features. Google property and account identifiers are not included in those artifacts. A recurring schedule stores only the exact selected Search Console and GA4 property identifiers, lookback, and enabled flags inside its encrypted account configuration. Recurring sync retains only compact evidence summaries in the scan context.

If you configure a Search rank watch, its exact priority queries, topic and funnel labels, preferred pages, query-page observations, and retained windows are stored in your browser and may enter an explicit encrypted Account upload or unencrypted Company backup. A recurring scan can carry the compact watch configuration and update it from the selected Search Console property. Public project and teammate views receive only bounded counts and review flags, not the priority-query list. SellSniper does not represent these Search Console averages as daily rank, causation, competitor share of voice, or complete demand.

Disconnecting either connection asks Google to revoke its token and removes that connection. Deleting the passkey account also asks Google to revoke and deletes its encrypted Google connection. Previously synced evidence remains until you remove it separately. You can also revoke access from your Google Account settings.

SellSniper's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google data is not sold or used for advertising.

If you install the SellSniper GitHub App, you choose which repositories it can access. Repository inspection uses read-only metadata and Contents access. The optional GitHub draft pull request feature additionally requires Contents write and Pull requests write permission.

SellSniper stores the verified installation identity in an encrypted HttpOnly cookie for at most 30 days. GitHub user tokens are used transiently to verify that the installation belongs to the authorizing user and are not stored. Installation access tokens are generated on demand, limited to one selected repository, and expire after about one hour. Inspection tokens stay read only. A write token is requested only after you explicitly confirm one reviewed draft pull request operation.

If you separately connect GitHub from Account, SellSniper stores the verified installation identity and saved permission metadata encrypted for that account, with an authorization expiry of 30 days. GitHub user tokens are not retained. Disconnecting removes this account record and pending authorization; account deletion also removes it. The GitHub App installation and Company browser connection remain independently manageable. Saving an account connection does not enable recurring coding or approve repository writes.

Account code proposals are saved encrypted with their source fragments, proposed changes, evidence limits, and review instructions. These records belong to the account and project and remain until account deletion, independently of workspace uploads or GitHub disconnection. Opening a historical proposal does not verify current repository source or approve a write.

Repository snapshots are stored in your browser. For a selected private repository, the compact snapshot can be included in an AI scan prompt, execution prompt, Markdown report, campaign history, or unencrypted Company evidence backup. Public share links are disabled for reports containing private repository context.

An Account recurring scan can store one exact public GitHub repository URL in its encrypted schedule and refresh that repository with the token-free public inspector. Each run requires the URL to remain the public repository in current matching Company context. Private GitHub authorization and installation tokens never enter recurring schedules.

A confirmed operation can exact-replace one reviewed value in one selected UTF-8 text file, create one isolated branch, commit that file on the branch, and open one draft pull request. It cannot write a workflow file or the default branch, request reviewers, merge, deploy, release, or change repository settings. The browser receipt excludes the exact current and proposed values and all credentials. Account upload can include that non-secret receipt, but private repository receipts cannot enter public share artifacts.

Disconnecting removes the browser connection but does not uninstall the GitHub App. You can change repository selection or uninstall the app in GitHub installation settings. Previously saved snapshots remain until you remove them separately.

If you use the browser WordPress connection, SellSniper verifies the exact HTTPS site and username with a separate revocable WordPress Application Password. The credential is submitted from the connection form for verification against that exact site, then encrypted in an HttpOnly cookie scoped to WordPress API routes for at most 30 days. It is not returned to the browser or stored in local storage, Account workspace, reports, share links, prompts, Markdown files, or product analytics.

A separate, optional account WordPress connection stores the Application Password encrypted on the server, bound to your signed-in account, for up to 30 days. Saving it requires explicit confirmation and replaces any existing account WordPress connection. It is separate from both the browser connection and the uploaded workspace. The server holds the encryption key; this is not end-to-end encryption. Connecting does not authorize a draft or publication.

The connection can read your WordPress user and list published core pages. After you review at least one local website field draft and explicitly confirm draft-only creation, SellSniper submits the reviewed exact current and proposed values to the WordPress adapter. The adapter can replace only an exact core page title, one unique Primary H1 value, or one unique body-copy or image-alt value while copying the selected page into a new WordPress page with draft status. Ambiguous or unsupported values are not applied. It does not copy the source slug or change the published page or its URL.

A saved Writer Agent article exposes a separate confirmation. When you use it, SellSniper sends the saved article text and the locally rendered PNG cover to the exact connected WordPress site, creates one new post with draft status, and tries to assign the uploaded cover as featured media. It does not select or update an existing post or page. The non-secret draft and media receipt is stored with the browser-local article and can enter an explicit encrypted Account upload, prompt, or Markdown report. The PNG bytes are not retained in those records.

Account page delivery retains encrypted exact current and proposed changes, the source page identity and fingerprint, destination site, and delivery outcome. Account article delivery reads a saved recurring-run article and requires separate approval for the exact article and cover. It retains the approved title, slug, metadata, prepared HTML, cover alt text, source-run identity and cover fingerprint with encrypted draft/media receipts and warnings. The cover PNG is sent to WordPress when approved but its bytes are not retained in these account records.

WordPress media can be publicly accessible even while the article remains a draft. A failed upload response does not prove the image was not stored. Pending and uncertain delivery records remain reserved to prevent automatic duplicate sends. Disconnecting removes the account credential but retains reviews and receipts for history and duplicate prevention until you delete the account. Account deletion removes these SellSniper records; it does not delete drafts or media already created in WordPress or revoke the Application Password there.

SEO plugin fields, page-builder metadata, forms, menus, templates, and redirects are not copied or changed. SellSniper has no WordPress operation for updating, publishing, or deleting a page. You review and publish the working draft manually in WordPress.

A non-secret receipt containing the source page, draft editor URL, warnings, reviewed local field-draft IDs, and applied or held outcomes is stored in your browser and can enter an explicit encrypted Account upload. Disconnecting removes the browser connection. You can revoke the Application Password in WordPress settings.

If you connect Webflow, SellSniper submits a separate revocable Site Token to the official Webflow API and accepts it only when exactly one accessible site has the scanned hostname. The token must have sites:read, cms:read, and cms:write. Writer cover delivery also needs assets:read and assets:write. It is then encrypted in an HttpOnly cookie scoped to Webflow API routes for at most 30 days. It is not returned to the browser or stored in local storage, Account workspace, reports, share links, prompts, Markdown files, or product analytics.

The connection can list CMS collections, editable Plain Text and Rich Text fields, and published source items in the primary CMS locale. After you review one Page or CMS content field draft and explicitly confirm staged creation, SellSniper submits the selected exact current and proposed values to the Webflow adapter. The current value must occur exactly once in the selected field.

The adapter copies bounded editable fields into one new staged CMS item, generates a unique working slug, and sets draft state explicitly. It does not change the published source item or reuse its slug. Active markup, code blocks, Webflow component markup, ambiguous matches, and unsupported fields fail closed. SellSniper has no Webflow operation for live items, publishing, updating, or deleting. You review and publish the staged item manually in Webflow.

A saved Writer Agent article exposes a separate confirmation. When you use it, SellSniper sends the saved article text and locally rendered PNG cover to the exact connected Webflow site. It maps the title, sanitized Rich Text body, optional summary, optional Image field, and required values copied from one published template item into a new staged draft. A selected cover is uploaded to publicly accessible Webflow asset storage before the staged item is created. Optional cover failure creates the draft without a cover; a required Image field failure stops before draft creation. If staged-item creation fails after a cover upload, that asset may remain in public storage and SellSniper reports its ID for manual review. The non-secret draft and asset receipt can enter an encrypted Account upload, prompt, or Markdown report. PNG bytes are not retained in those records.

A non-secret receipt containing site, collection, source and draft IDs, the generated slug, warnings, reviewed local field-draft ID, and applied field outcome is stored in your browser and can enter an explicit encrypted Account upload. The receipt does not contain the Site Token or the exact current and proposed values. Disconnecting removes the browser connection. You can revoke the Site Token in Webflow settings.

If you connect Framer, SellSniper submits an exact Framer project URL and separate project-scoped API key to the official Framer Server API. It accepts the connection only when the project's published production hostname exactly matches the scanned hostname. The key is then encrypted in an HttpOnly cookie scoped to Framer API routes for at most 30 days. It is not returned to the browser or stored in local storage, Account workspace, reports, share links, prompts, Markdown files, or product analytics.

The connection can list editable user-owned CMS collections, String and Formatted Text fields, and published source items. After you review one Page or CMS body field draft and explicitly confirm draft-only creation, SellSniper submits the selected exact current and proposed values to the Framer adapter. The current value must occur exactly once in the selected field.

The adapter copies bounded supported fields into one new CMS item, generates a unique working slug, and sets draft state explicitly. It does not change or remove the published source item or reuse its slug. Active markup, ambiguous matches, unsupported required fields, and oversized payloads fail closed. SellSniper has no Framer operation for publishing, deploying, updating, removing, redirecting, page or canvas editing, or code changes. You review and publish the draft manually in Framer.

A saved Writer Agent article exposes a separate confirmation. When you use it, SellSniper sends the saved article text and locally rendered PNG cover to the exact connected Framer project. It maps one String title, sanitized Formatted Text body, optional String summary, and optional Image cover into a new CMS item with draft state. Optional image failure creates the draft without a cover; a required selected Image field failure stops before draft creation. If CMS item creation fails after upload, that asset may remain in the project and SellSniper reports its ID for manual review. The non-secret draft and asset receipt can enter an encrypted Account upload, prompt, or Markdown report. PNG bytes are not retained in those records.

A non-secret receipt containing project, collection, source and draft IDs, the generated slug, warnings, reviewed local field-draft ID, and applied field outcome is stored in your browser and can enter an explicit encrypted Account upload. The receipt does not contain the API key or the exact current and proposed values. Disconnecting removes the browser connection. You can revoke the project API key in Framer Site Settings.

If you connect Wix, SellSniper submits a separate owner or co-owner generated API key and exact Wix site ID to the official Wix REST API. The key must have Read Site URLs, Read Data Items, and Write Data Items access. SellSniper accepts the connection only when a published site URL exactly matches the scanned hostname. The key is then encrypted in an HttpOnly cookie scoped to Wix API routes for at most 30 days. It is not returned to the browser or stored in local storage, Account workspace, reports, share links, prompts, Markdown files, or product analytics.

The connection can list bounded text fields from published items in a user-created CMS collection. After you review one Page or CMS content change and explicitly confirm draft-only creation, SellSniper reloads the published source item and requires the exact current value to occur once in the selected field.

The adapter copies that item into the collection's Wix drafts shadow collection, then patches one exact reviewed text value in the shadow item. The published item and public URL remain unchanged. Existing conflicting drafts, active markup, ambiguous matches, unsupported fields, redirects, and oversized responses fail closed. SellSniper has no Wix operation for publish, unpublish, page editing, site actions, live updates, or deletion. You review and publish manually in Wix. Wix labels the draft-copy API as Developer Preview.

A non-secret receipt containing the site, collection, source and draft IDs, warnings, reviewed local field-draft ID, and applied field outcome is stored in your browser and can enter an explicit encrypted Account upload. The receipt does not contain the API key or the exact current and proposed values. Disconnecting removes the browser connection. You can revoke the API key in Wix Account Settings.