Privacy Policy

Last updated: 28 October 2026

1. Who we are

Cluster Army (https://cluster.army, "the app", "we", "us") is a free suite of SEO tools operated by EVE Milano by Searcus Swiss Sagl, Via dei Faggi 4V, 6912 Pazzallo, Switzerland (UID CHE-180.818.315), office in Via Penate 16, 6850 Mendrisio, Switzerland. We are responsible for the personal data described in this policy. Contact: giovanni(at)searcus.ch.

This policy explains which data the app collects, including the data it receives from Google APIs when you sign in with Google or connect Google Ads, and how that data is used, shared, protected, kept and deleted.

2. Tools you can use without signing in

Long Tail Generator, Keyword Clusterizer, Log Analyzer and WebP Converter work without a Google account. The keywords, files and images you submit are processed on our server only to produce the result you asked for, and the results are deleted automatically (see section 7). The Long Tail Generator requests keyword suggestions from Google Autocomplete directly from your browser.

3. Google user data we access

When you sign in with Google or connect Google Ads, Google asks for your consent to the permissions (OAuth scopes) below. We ask for each permission only for the features listed in section 4.

Basic profile (userinfo.email, userinfo.profile): your email address, whether Google has verified it, your name and the address of your profile picture. Requested at sign-in and when you connect Google Ads.
Google Search Console (webmasters.readonly, read-only), requested at sign-in: the list of Search Console properties you have access to, with your permission level, and Search Analytics data (clicks, impressions, CTR and average position by query, page, date, country and device) for the property and the period you choose in a tool. In GSC AI Chat the assistant can also read the sitemaps and the URL Inspection results of the property you ask about. The app does not change anything in Search Console.
Google Ads (adwords), requested only when you click "Connect Google Ads" on the Google Ads Dashboard or in the Long Tail Generator: the list of Google Ads accounts you can access (account ID, name, currency and manager relationships), their performance over the last 90 days (cost, clicks, impressions and conversions) and Keyword Planner historical metrics (average monthly searches, monthly trend, competition and top-of-page bid range) for the keywords of your Long Tail run. Google does not offer a read-only permission for the Google Ads API: the app only reads data and never creates, changes or deletes campaigns, keywords, budgets or settings.

Google also gives the app OAuth access and refresh tokens, which let it call these APIs on your behalf until you revoke them.

4. How we use Google user data

We use Google user data only to provide and improve the features you use:

Sign-in: your email, name and picture identify your account, show who is signed in and let you sign out.
Search Console tools (Outdated Content, Cannibalization, Bulk Export, Title Optimizer, GSC AI Chat, Search Console Dashboard): we read the data you request and show it to you, and only to you, as tables, charts and Excel files.
AI features: to suggest titles in Title Optimizer, or to answer your questions in GSC AI Chat, the relevant Search Console data (for example the top queries of the page you chose, or the results of the queries the assistant runs to answer you) and your question are sent to the Google Gemini API (see section 5).
Google Ads Dashboard and search volumes: we read the data described in section 3 and show it to you. Search volumes are added to your Long Tail results and to their Excel file.
Daily limit: each search-volume lookup is logged (your email, the Google Ads account ID used, the country, the number of keywords and the time) to enforce a limit of 30 lookups per day.
Your properties: we store the list of your Search Console properties (URL and permission level, without any traffic data). It is updated when you sign in and once a week while your account is active (signed in within the last 180 days), to keep an internal record of which sites use the tools and to provide support.
Account record: we keep your email, name and picture, the dates of your sign-ins, the permissions you granted, the tools you used (tool, action, the property involved and the time) and how you first arrived on the site (see section 9), to run and support the service and to understand how the tools are used.

We do not use Google user data for advertising, we do not sell it, we do not use it to decide on credit or lending, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

5. Sharing and transfer

We do not sell, rent or share Google user data with third parties, with these exceptions:

Google Gemini API: for Title Optimizer and GSC AI Chat, the data described in section 4 is sent to the Gemini API, operated by Google, under Google's terms for paid services: Google does not use these prompts and responses to improve its products and keeps them only for a limited time to detect abuse.
Hosting: our server is hosted by DigitalOcean in Frankfurt, Germany. DigitalOcean stores the data on our behalf and may not use it for its own purposes.
Legal obligations and security: when the law requires it, or to protect against fraud, abuse or security threats.
Change of ownership: in a merger, acquisition or sale of assets, only after asking for your consent.

A Long Tail results link can be opened by anyone who has it, for 7 days. It contains the keywords of the run and, if you added them, their search volumes, but no account data.

6. How we protect your data

All traffic between your browser and cluster.army is encrypted with HTTPS (TLS). The session cookie is sent only over HTTPS and cannot be read by scripts on the page.
Data is stored on a server in Germany, in a database that accepts connections only from the application on the same server and cannot be reached from the internet.
Server administration requires the operator's SSH key. Brute-force and abusive traffic is blocked automatically, and the server is checked by an hourly security monitor.
Every request is tied to your session: you can see only your own Google data. OAuth tokens are never shown in the interface and never written to logs.
Only the operator's administrators can see account records, after signing in with Google.
We ask for read-only Search Console access, ask for Google Ads only when you need it, and keep data only for the periods in section 7.

7. Retention and deletion

Search Console and Google Ads data shown in the tools: processed in memory to build your report and not stored, except as listed below. The list of your Google Ads accounts is kept in your session for 10 minutes, so that the dashboard does not ask Google again on every page.
Files generated by the tools (Excel exports, Cannibalization and Bulk Export files, Long Tail and Clusterizer results): deleted automatically after 7 days. Uploaded log files and converted images: deleted after 24 hours.
GSC AI Chat conversations: kept until you delete them, and deleted automatically after 30 days in any case. Deleting a conversation erases it permanently.
Search-volume lookup log: deleted after 24 hours.
List of your Search Console properties: kept while your account exists.
Account record and OAuth tokens: kept until you ask us to delete them. If you revoke the app's access in your Google Account, the tokens stop working at once and are no longer used.
Usage records of visitors who are not signed in: deleted after 13 months.
Sessions: expire after 2 weeks; expired sessions are deleted every night.
Web server logs (IP address, browser, page requested): deleted after 14 days.
Database backups: kept for 14 days, so deleted data also disappears from backups within 14 days.

To delete your data, write to giovanni(at)searcus.ch from the email address of your Google account. We delete your account record, tokens, property list, conversations and logs within 30 days and confirm it by email. You can also revoke the app's access at any time from your Google Account permissions page.

8. Limited Use

Cluster Army's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See the Google API Services User Data Policy.

9. Cookies and browser storage

sessionid: keeps you signed in; expires after 2 weeks.
csrftoken: protects forms against cross-site request forgery.
ca_ft: a first-party signed cookie set on your first visit. It records how you first arrived (source, medium and campaign of the link, referring website, landing page and date) and lasts 180 days. If you sign in, these values are saved in your account record. It is not shared and not used for advertising.
Browser storage: some tools remember your choices in your browser (for example the Google Ads account and the country last used for search volumes). This data stays on your device.

We do not use Google Analytics, advertising cookies or third-party tracking.

10. Your rights

Under the Swiss Federal Act on Data Protection and, where it applies, the EU General Data Protection Regulation, you can ask to access, correct, delete or export your personal data, object to or restrict its processing, and withdraw your consent at any time by revoking the app's access. You can also complain to the Swiss Federal Data Protection and Information Commissioner or to the data protection authority of your country.

11. Children

Cluster Army is a professional tool and is not intended for people under 16.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. If we change how we use Google user data, we will ask for your consent again where required.

13. Contact

EVE Milano by Searcus Swiss Sagl
Via dei Faggi 4V, 6912 Pazzallo, Switzerland
Office: Via Penate 16, 6850 Mendrisio, Switzerland
Email: giovanni(at)searcus.ch