Privacy — the platform

Last updated October 15, 2026. This page describes app.flaremark.com, the visibility platform. The practice’s own site measures its visitors with Google Analytics 4 and nothing else — that page is this site’s privacy policy.

The one-paragraph version

You sign in with an email address. You connect read-only analytics sources — Google Search Console, Google Analytics 4, Bing Webmaster Tools, and services as they ship here — and the platform reads your own search and analytics data to build your reports. The connecting credentials are stored encrypted on the server, never displayed, and revoking a connection deletes them here and on the provider’s side. Cached reports stay until you ask for your account to be deleted.

Accounts and sign-in

You sign in with an email address: the platform emails a one-time sign-in link (delivered through Resend, the practice’s email processor), and you may add a second-factor code (TOTP) for extra protection. What sign-in requires is held or created: your email address, the code secret if you enroll, and a session record while you are signed in. Nothing else about your email habits — no open tracking, no mailing list, no resale.

Connections you make

Every connection is a read-only grant that you create yourself from your settings — each consent screen lists the exact scope before you accept (Google Search Console: webmasters.readonly; Google Analytics 4: analytics.readonly; Bing Webmaster Tools and later platforms: their read scopes, listed the same way when they ship).

The platform records the grant — what was granted, when, and which account connected it — in a consent record you can see. Revoking deletes the stored credential on this side at the same moment — and for Google grants it also revokes the grant Google-side. Microsoft does not offer a revocation endpoint: to remove the Bing grant entirely, remove the app in your Microsoft account’s consent list.

The authorization tokens those grants mint are stored encrypted on the platform’s server (AES-256-GCM), never displayed anywhere, never shared, and used only to read your own data.

What is kept while you are connected

The data the platforms let the platform read: search and analytics rows (clicks, impressions, sessions), the reports and findings built from them, and the weekly digest emails. Cached reports survive a disconnect — your history stays in your tenant’s data until your account is deleted.

Leaving, and asking for deletion

Disconnecting is yours to do from your settings, any time: the grant is revoked at the provider, and the stored credential is wiped here in the same motion.

Account deletion is a request: contact the practice and the account, its sessions, its pulled data and its reports are removed. Two things persist by design, both stated here: the append-only audit log of connection events (it is hash-chained for integrity, contains no credentials, and after deletion its event rows are no longer linkable to you), and your consent record, which the practice retains as proof of the grant — also de-linked from your identity after deletion.

Who processes what

Cloudflare: hosting, the database, and the encrypted credential storage. Google: the origin of the data you connected (Search Console, Analytics 4) — the platforms govern their own data policies. Resend: email delivery for sign-in links and the weekly digest.

What this page never has to say

No advertising, no ad cookies, no data sale, no data brokerage. The platform’s reports tell you what the engines measured — including where they measured nothing — and the platforms stay in charge of their own data.

Who is responsible

FlareMark is the practice of Harvey A. Ramer, operating under Resurrection Publishing LLC (Memphis, Tennessee, United States). Questions about anything on this page go to [email protected].