privacy
What this site stores, why it stores it, and how long it keeps it. This page describes what the software actually does.
what we store
Your email address. It is your account — there is no password, so signing in means receiving a six-digit code at that address. We use it to sign you in, to send receipts, and to tell you when a word of yours is taken.
A one-way hash of your IP address. Never the address itself. It is recorded against your acceptance of the terms, against any listing you report, and inside the counters that stop one person flooding the sign-in system. A hash cannot be turned back into an address.
Your transactions. Which words you bought, what you paid, what credit you hold, and when. This is the ledger the site is built on and it is permanent — clause 2 of the terms explains why credit and stakes never expire.
Your listing. The title, link and description you attach to a word. These are public by design: they are what other people see on that word’s page.
what we never store
Card details. Payments are handled entirely by Stripe. Card numbers are entered on Stripe’s own page and never reach this server — we receive only a payment reference and the amount.
Your name. There is nowhere to enter one and nothing displays one. On a word’s page an owner appears as their own title and link, and as nothing else.
Your IP address in the clear. Our records keep only hashes, as above. The companies below see the address itself while serving and measuring the request — anything on the internet does — but it is never written into our own database.
how long we keep it
Sign-in codes expire in ten minutes and are deleted nightly. Sign-in sessions expire after thirty days and are deleted nightly. The counters that rate-limit sign-in are deleted nightly once their window closes. Your account, your listings and your transaction records are kept for as long as the account exists, because they are the record of what you bought.
who else sees it
Stripe processes payments and receives your email address so it can send you a receipt. SendGrid delivers our email and therefore handles your address and the contents of those messages. Cloudflare hosts the site and stores its database. PostHog receives the usage measurements described below. Those four, and nobody else. We do not sell your data, and we do not hand it to advertisers or data brokers.
how we measure the site
Two different things run here, and they are worth separating because one of them can recognise you and the other cannot.
Our own counters. Page views and link clicks, counted on Cloudflare’s infrastructure. Each record holds an event name and a keyword and nothing else — no account, no address, no identifier. The click totals on word pages come from these.
Product analytics. We use PostHog to understand how people move through the site — which pages get read, where a claim is abandoned, what breaks. This is the part that can tell one browser from another: it stores a random identifier so a second visit is recognisable as the same browser, and it receives the pages you open, the page that sent you, your browser and device type, and your IP address. If you are signed in, we may link those events to your account so we can tell a returning owner from a new visitor.
It does not receive your card details, which never reach us either, and it is not used to build a profile for advertising or to sell to anyone.
cookies
Signing in sets one cookie. It is what keeps you signed in for thirty days and there is no way to use an account without it.
Measuring sets the analytics identifier described above. Clearing your browser’s storage for this site removes it, and your browser’s “do not track” setting is honoured where the tool supports it. Blocking it costs you nothing: every part of this site works the same either way.
email you can turn off
Receipts and sign-in codes are not optional: they are how the service works. The notification telling you a word of yours was taken is, and every one of those carries a one-click unsubscribe link.
your choices
You may close your account at any time from your account page. Closing it forfeits any balance and any listings, as clause 10 of the terms sets out. To ask what we hold about you, or to ask us to delete it, write to support@keywordwars.lol — bearing in mind that transaction records supporting a payment may need to be kept.
changes
When this page changes materially we will say so by email. The terms are versioned separately, and every version you have ever accepted stays readable at its own address.