Privacy Policy

What it reads

The extension runs only on Amazon’s store pages in the 22 countries it supports. There it reads the text you type in Amazon’s search box, the department picked in the menu next to it, and which Amazon country you are on. It doesn’t read your Amazon account, orders, cart or the rest of the page, and it doesn’t run on other websites.

Where it sends your searches

Your browser sends what you type, and variations of it, to Amazon’s public search suggestion service for that country. These requests go straight from your browser to Amazon, not through our servers, and they leave out your Amazon cookies, so Amazon can’t tie them to your Amazon account. Amazon still sees them as it sees any request from your browser, including your IP address. Amazon’s own privacy notice covers what Amazon does with them.

What it keeps in your browser

The extension stores these in your browser’s extension storage. They stay on your computer, and we can’t see them:

• keywords you save;
• your settings: the country override, exclude words, and whether you hid the dropdown;
• two counters (Deep Expand runs and exports) and your answer, used to decide when to ask you to rate the extension;
• recent suggestion results, for up to 24 hours, so a repeat search is instant. The browser clears these when it closes.

Pro adds two more, described in section 2.

What it sends to us

• Settings updates. At most every 6 hours, the extension asks our API (api.shopperwords.com) for settings that fix how it talks to Amazon, for example when Amazon moves its suggestion service. The request holds nothing about you or your searches.
• Failure reports. When suggestions fail for a country, the extension tells our API the country, how many requests failed out of how many, and the extension version, so we can fix it. A report never holds what you typed or any keyword. Each browser sends at most one per country per hour.

The extension sends no analytics and no usage tracking.

Copying and exports

Copied keywords go to your clipboard, and exports are files saved on your computer. Pro exports hold links that search each keyword on Amazon, Google Search and Google Trends; your browser contacts those sites only if you open a link.

Your license key

When you paste your license key into the extension, it sends the key to our API, which asks Polar, our payment provider, whether the key belongs to an active subscription. The extension checks again at least every 6 hours. We store keys Polar has confirmed only as a SHA-256 hash, with the times we last checked them, never the key itself. The extension keeps the key in your browser until you remove it in Settings.

Search volume

To show search volume, the extension sends our API the keywords on your screen, which include the words you typed, with the Amazon country and your license key. Our API answers from its own store of earlier results, or asks a third-party keyword data provider. We send the provider only the keywords and the Amazon country: not your license key, your IP address or anything else about you.

We keep each result by keyword and country, so the next person who looks up the same keyword gets it without a new request. These records aren’t tied to you or your key. We ask the provider again once a result is 30 days old, and delete results nobody has looked up for 12 months.

The extension also keeps search volume it has fetched in your browser for up to 7 days, at most 5,000 keywords, so repeat searches don’t ask our API again.

Limits on requests

To stop abuse, our API allows each IP address a limited number of license and volume requests a minute. Our host, Cloudflare, counts these for us; our code doesn’t store your IP address.

Polar (polar.sh) sells Pro as the merchant of record. Polar runs the checkout, takes your payment, charges any tax, sends invoices, issues your license key and runs the portal where you manage or cancel your subscription. You give your payment details to Polar, not to us, and we never see your card details.

Polar shares with us your name, email address, billing address and country, any tax ID you give, and the details of your orders and subscription. We use them to run your subscription and answer your questions. Polar’s privacy policy covers what Polar does with your data.

shopperwords.com has no accounts, no sign-up forms and no ads, and it sets no cookies.

• Hosting. Cloudflare hosts the website and our API. Like any host, Cloudflare receives your IP address and browser details with each request. We keep Cloudflare’s logs on to catch errors. They record requests to our API and their responses, with details Cloudflare has about each request, which can include your IP address and rough location. Cloudflare deletes these logs after at most 7 days.
• Analytics. We count page visits with cookieless analytics that we run on our own server in the United States. It records the page address, the referring site, your browser, operating system, device type and screen size, your country (worked out from your IP address, which it doesn’t store), and when and how long you visit. It doesn’t follow you across other websites. We keep this data for 12 months.
• Email. If you email us, we keep your message and address for 2 years, to answer you and to look back at past questions.

Links to Polar and the Chrome Web Store take you to their sites, where their own policies apply.

We don’t sell your personal data, and we don’t share it with advertisers or for advertising. We use these providers to run Shopperwords:

• Cloudflare: hosting for the website and API, logs, and request limits;
• Polar: payments, invoices, license keys and the customer portal;
• a third-party keyword data provider: search volume for keywords, with no data about you;
• our email provider: the support inbox.

We may also share data when the law requires it, such as to answer a court order or a lawful request from a public authority, or when we need to protect the rights or safety of our users, the public or Shopperwords. If Shopperwords Inc. merges with or is sold to another company, your data may pass to the new owner, who must keep the promises in this policy.

• Data in your browser: until you delete it or remove the extension.
• License key hashes: deleted 90 days after the license ends.
• Search volume results: deleted after 12 months with no lookup.
• Failure reports: we don’t store them. If the country fails for our own check too, we log a one-line alert with the same details, which Cloudflare deletes with its other logs.
• Cloudflare’s logs: at most 7 days.
• Support emails: 2 years.
• Website analytics: 12 months.

You control most of your data yourself:

• Delete saved keywords in the extension’s settings, or remove the extension to delete everything it stored.
• Remove your license key in Settings, under Billing.
• Manage or cancel your subscription in Polar’s customer portal, linked from Settings.

Depending on where you live, you also have the right to:

• know what personal data we hold about you and get a copy of it;
• have it corrected if it’s wrong;
• have it deleted;
• get it in a format you can move to another service;
• object to or limit how we use it;
• complain to your data protection authority.

To use any of these rights, email support@shopperwords.com. We may ask you to confirm who you are first, for example by writing from the email address you used to buy Pro. We won’t treat you differently for using your rights.

We can’t match cached keyword results or failure reports to a person, because we never store them with a key, account or IP address.

Where EU or UK data protection law applies, we rely on these legal bases:

• contract, to provide Pro: license checks, search volume lookups and payments through Polar;
• legitimate interests, to run and protect Shopperwords: the free features, failure reports, website analytics, security and abuse prevention;
• legal obligation, for tax and accounting records, which Polar keeps.

Our providers process data in several countries:

• Cloudflare answers requests from its network of data centers around the world, so a request may be handled in any country it runs in;
• Polar may store data in the United States, Canada and other countries outside the EEA and the UK;
• our analytics server is in the United States;
• our email provider stores support email on its own servers.

The extension talks to Amazon and to our API only over HTTPS, and we store license keys only as hashes. No system is perfectly secure; if you think something is wrong, email support@shopperwords.com.

Shopperwords is for people 18 or older. We don’t knowingly collect data from anyone younger. If you think a child has given us data, email support@shopperwords.com and we will delete it.

When we change this policy, we update this page and the date at the top. For important changes, we also email Pro subscribers at least 30 days before the change takes effect.

Questions about privacy: support@shopperwords.com.