matchstick

Privacy

Last updated October 20, 2026

Matchstick reads your Search Console, crawls your public pages, and drafts fixes as pull requests. This page says what that involves, what we keep, who else sees it, and what an agent you connect can see.

What we collect

  • Your account. Your GitHub login and name when you sign in, and the email address on the Google account you connect. We use the email for the daily digest and billing receipts.
  • Search Console data. With your consent, read-only access to the properties you choose: clicks, impressions, positions and indexing status, per page and per query. We import up to 16 months of history when you connect, then one day at a time.
  • Your site’s public pages. Matchstick crawls the pages Search Console reports, the way a search engine would, and keeps titles, headings, links and a few performance measurements.
  • Repository contents. If you install the GitHub App, Matchstick reads the repositories you pick, only to draft a fix, and writes only to a branch of its own and the pull request it opens. It never pushes to your default branch.
  • Cloudflare settings. If you connect Cloudflare, Matchstick reads the zone settings it needs for a check, and changes a setting only when you click Apply; every change can be undone from the same page.
  • Agents you connect. When you connect an AI agent (through OAuth, or with a personal API key), we keep the client’s name, the sites and permissions you granted it, the budget you set, when it was last used, and a log of every call it makes. Its access tokens are stored as hashes we can’t read back.
  • Billing. Card details go straight to Stripe and never touch our servers. We store the Stripe customer id, your plan, and credit usage.
  • Logs. Ordinary server logs (request paths, timings, errors) kept for a short time to run the service.

How we use it

To find what is costing your site clicks, to draft and verify fixes, and to send you the reports you signed up for. We don’t sell data, show ads, or use your data to train models.

Some of the work is done by providers acting on our instructions: model providers (Anthropic and OpenAI) receive the page content, Search Console rows and code excerpts a specific analysis or fix needs; keyword and backlink providers (Ahrefs and DataForSEO) receive the domains and queries being researched; Postmark delivers email; Stripe handles payment. Each is bound by its own terms to use what it receives only to provide the service to us.

Matchstick’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Agents you connect

You can let an AI agent use Matchstick as you: an MCP client such as claude.ai, ChatGPT, Grok, Claude Code or Cursor through OAuth, or a script with a personal API key. On the consent page you choose which sites it may see and what it may do (see; run research and draft fixes; review; approve), and a weekly credit budget. It acts as you within those choices, and never beyond your own access.

Through that connection the client’s operator receives what you can see of those sites: Search Console clicks, impressions and positions by page and by query; what our crawl found on each page; findings and the evidence behind them; changes with their diffs and reviews; weekly reports; and the account’s activity trail. It never receives your sign-in, your tokens, billing details or anything about other accounts. What the client’s operator does with what it receives is governed by their terms, not ours; the connection is yours to make.

Every call an agent makes is listed on the site’s Activity page with the client’s name. Nothing about your site is published anywhere. You can revoke a connection at any time from Settings → Connected agents (OAuth) or Settings → API keys; revocation ends its access immediately, and its logged calls stay with your account’s history.

What we keep, and for how long

Access tokens are encrypted at rest. Search Console history, crawl results and reports are kept while your account is active so the weekly report can compare against the past. When you cancel, everything is deleted 30 days later; email [email protected] to have it removed sooner.

You can revoke Matchstick’s access at any time: from Connections inside the app, from your Google account permissions, or by uninstalling the GitHub App. Revoking stops new data from arriving; deletion follows the schedule above.

Cookies

One cookie, to keep you signed in, and a short-lived one that carries an agent’s connection request through sign-in. No analytics or advertising trackers on any page.

Questions

Write to [email protected]. If this policy changes in a way that matters, we’ll email you before it takes effect.