Security and privacy

We measure agents, not people.

Airglow is built so you can see what AI agents do on your site without tracking the people who visit it. Here's exactly how your data and your visitors' data are handled.

No identification

Airglow never identifies people or companies. No user IDs, no fingerprints.

Cookieless by default

Nothing is stored on a visitor's device unless you turn on cookie mode and they agree.

Agent-only replays

Replays are recorded for AI agents and automated browsers only, never for people.

IPs never stored

IP addresses are turned into a daily-rotating hash in memory and then thrown away.

Visitor data

What Airglow collects, and what it never does.

What we collect

Pages viewed, referrer and timing
The browser's user agent and signals that show an AI agent or automated browser
Counts of shares, copies, embeds and translations, never their content
Consent signals from your cookie banner

What we never collect

Names, email addresses or user IDs of your visitors
Fingerprints or cross-site identifiers
Stored IP addresses
Form contents or request bodies
Recordings of people

Cookieless unless you choose otherwise.

Each website has a tracking mode. Cookieless works for everything Airglow does. Cookie mode joins a visitor's pages more accurately, and only ever runs with consent.

Mode	What happens
Cookieless Default	Nothing is stored on or read from the visitor's device. Agent detection, replays and analytics all work.
Cookie mode	A first-party cookie is set only after the visitor allows it through your cookie banner. If they decline, Airglow keeps working in cookieless mode for that visitor.

How we protect your account

Built in, not bolted on.

Ownership checks

Live data starts only after you prove you own a website with a DNS record or a meta tag. Until then, nothing from real visitors is collected.

Workspace isolation

Every request is scoped to one workspace. Data from one client can never be read from another workspace.

Passwordless sign-in

Sign-in links are single-use and expire after 15 minutes. There are no passwords to leak.

Encrypted connections

All traffic uses HTTPS. Google access tokens are encrypted at rest with AES-256 and rotated keys.

Backups

Your workspace data is backed up daily and kept for 35 days, on top of point-in-time recovery.

AI providers

AI tests send your questions and your public pages to AI providers. Visitor data is never sent to them.

Infrastructure

Runs on Cloudflare.

Airglow runs on Cloudflare's global network, with its database, storage and queues there too. Uptime is public on our status page.

View status

Data	Kept for
Google Analytics imports	800 days
Search Console imports	500 days
BigQuery events	90 days
Agent replays	30 days on Free, 90 days on Pro
Backups	35 days
Account data after you close an account	Deleted within 30 days

More detail

Policies and contact.

Privacy policy

What we collect, why, how long we keep it, and your rights.

Read the policy

Sub-processors

The providers we use to run Airglow, and what each one does.

See the list

Report a security issue

Email support@airglow.so with “Security” in the subject. We'll reply quickly.

Questions

For anything else about data and privacy, email support@airglow.so.