1. Who we are

KeywordCracker is a keyword and topic discovery Service that suggests related phrases from configurable sources (including local or live Wikimedia-derived data and, where offered, unofficial Google Autocomplete), lets you organise those phrases in Explorer, Tree, and Map, and export keepers when signed in.

For privacy requests, contact us at the address in the Contact section below. If a separate legal entity name and postal address are published on the Service, those details identify the controller for personal data processed through the Service.

2. Information we collect

We collect information you provide, information created when you use the Service, and limited technical data needed to operate and secure the Service.

2.1 Account and profile data

Name and email address when you register or update your profile.
Password (stored as a secure one-way hash; we do not store the plain password).
Email verification status and related verification tokens.
Password reset tokens when you request a reset.

2.2 Project and research data

Seed keywords, project names, slugs, column layouts, phrase saves (saved, rejected, unsaved), and related board state.
Guest project tokens and temporary guest boards.
Optional known-keyword lists and suggestion feedback tied to an account.
Export and download activity associated with projects where the product records it.

2.3 Technical and usage data

Session identifiers and CSRF tokens needed for signed-in and guest use.
Approximate request metadata such as IP address, user agent, and timestamps in server or application logs.
Cache entries for provider responses (for example Wikimedia lookups) so repeated queries can be served efficiently.

2.4 Data we do not sell

We do not sell personal information. We do not use seed keywords or project boards to build advertising profiles for third-party ad networks.

3. How we use information

We use information to provide, secure, and improve the Service, including to:

Create and authenticate accounts, verify email addresses, and reset passwords.
Run discovery requests against the selected provider, cache eligible responses, and display Explorer, Tree, Map, and Export.
Save, rename, open, claim, and delete projects; save and reject phrases and manage account workspace lists.
Enforce rate limits and abuse protections.
Send transactional email (verification, password reset, and similar service messages).
Diagnose faults, measure reliability, and maintain the Service.
Meet legal obligations and respond to lawful requests.

4. Legal bases (EEA/UK and similar frameworks)

Where a legal basis is required, we typically rely on:

Contract — processing needed to provide the Service you request (account, projects, discovery runs, export).
Legitimate interests — securing the Service, preventing abuse, basic analytics of reliability, and improving features in ways that do not override your rights.
Consent — where we ask for consent for a specific optional processing activity.
Legal obligation — where we must retain or disclose information to comply with law.

5. Sharing and processors

We share personal data only as needed to run the Service or as required by law.

5.1 Service providers

Hosting, database, email delivery, logging, analytics (Google Analytics 4 on the live production site), and similar infrastructure providers may process data on our instructions. They are not authorised to use it for their own marketing.

5.2 Discovery providers

When you select a live external discovery source, the seed or query text is sent to that provider’s systems (for example Wikimedia project APIs, or an unofficial Google Autocomplete endpoint). Those providers process the query under their own terms and policies. Local index runs keep discovery against data we host, subject to Wikimedia licensing for the underlying content.

5.3 Public project links

Project URLs that include a project slug can be opened by anyone who has the link. Do not put secrets in project names or seeds, and do not share links that should remain private. Account deletion removes the login; existing research reachable by public links may remain available as stated in product messaging.

5.4 Legal disclosure

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, and integrity of the Service and its users.

6. Cookies and similar technology

The Service uses cookies and similar storage that are necessary for operation, including:

Session cookies so you stay signed in or retain a guest session while browsing.
Security tokens (such as CSRF protection) for form submissions.
Limited local or session storage in the browser for UI state where the product requires it.

Analytics and advertising cookies

On the live production site, Google Analytics 4 (gtag.js) may set analytics cookies to measure usage and improve the Service. The Service does not use third-party advertising cookies. If marketing cookies are introduced later, this policy will be updated and, where required, consent controls will be provided.

7. Retention

We keep personal data only as long as needed for the purposes above, including:

Account data — for the life of the account, then deleted or anonymised after account deletion except where retention is required by law or for security disputes.
Projects and board data — while associated with an account or active guest session; public-link behaviour after account deletion is described above.
Provider cache entries — for a limited cache window (for example on the order of weeks for some Wikimedia responses) then expire or are replaced.
Logs — for a limited operational period unless a longer period is needed for security investigation.
Email verification and password reset tokens — until used or expired.

8. Security

We use industry-standard measures appropriate to the Service, including hashed passwords, HTTPS where configured on the deployment, session controls, and rate limiting on sensitive endpoints. No method of transmission or storage is completely secure; you are responsible for keeping account credentials confidential.

9. International transfers

The Service may be hosted or supported in countries other than your own. Where personal data is transferred internationally, we take steps required by applicable law (such as appropriate contractual clauses or equivalent safeguards) when those laws apply to us.

10. Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict certain personal data, to object to certain processing, to withdraw consent where processing is consent-based, and to lodge a complaint with a supervisory authority.

You can update profile details and delete your account from the account page when signed in. For other requests, email the contact address below. We may need to verify the request before acting on it.

11. Children

The Service is not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to remove it.

12. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the Service after an update means you accept the revised policy, except where applicable law requires additional notice or consent.

13. Contact

Privacy questions and requests: privacy@keywordcracker.com

For product how-to questions, see the Help page linked in the site footer.