Privacy

The extension reads the text of a page so it can find new words: the page you ask it to scan, or, with automatic scanning on, the pages you visit. That happens entirely in your browser. Page text and page addresses never leave your browser.

Automatic scanning is off until you turn it on. It starts only after you choose “Turn on automatic scanning” in the first-run notice, or turn on “Watch pages as I browse” in the popup. Installing the extension doesn't start it.

• Sent to NameHawk: only candidate domain names, such as vibecoding.com, up to 20 per page, to check whether they're available, and the domains saved in Your finds when you press “Check again” or “Check all again” there. They're built from words on the page, and NameHawk picks the words least common in English, which is why the sites below are left alone. On a page you didn't ask it to scan, anything that reads as a person's name is dropped before checking, so a name on the page isn't what gets looked up. Press “Scan this page” and names are included, because you chose the page. They go to namehawk.co, which asks our availability service (below).
• Kept on your device only: the domains you've found, with the titles and addresses of the pages you found them on (“Your finds”; each address is kept as its site and path only, without anything after a “?” or “#”, and with token-like parts of the path replaced by “:id”); availability answers from the last 7 days at most, so repeat visits don't ask again; your settings; and each open tab's address, title and results, kept until the tab closes; and the addresses and sites of recently scanned pages, used to pace automatic scanning and kept until the browser closes. All of it stays in your browser's extension storage, and you can clear your finds and the saved availability answers at any time from the Your finds page. Uninstalling the extension removes all of it.
• Not scanned automatically: well-known email, messaging, dating, banking, health, school, adult and work sites (such as Jira, Linear, Asana, Salesforce, code hosting, cloud consoles, HR and payroll), search results, common account, order and checkout addresses on any site, AI chat assistants, documents and file storage, government accounts (tax, social security and ID), and sign-in and password sites; local-network addresses and intranet-style hostnames (such as .local, .corp or intranet.); and any page that asks search engines not to index it. The list is of well-known sites, so a site it doesn't know isn't covered: you can switch automatic scanning off entirely or exclude any site, and “Scan this page” still works anywhere you ask it to.
• The extension doesn't run in incognito (private) windows.
• The extension has no sign-in, no analytics and no ad tracking. Its Register links may be affiliate links (see below).
• NameHawk's use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: it's used only to check domain availability, to protect the service from abuse and, when you click Register, to send the one domain name to the registrar you chose and, where one is used, its affiliate network (see below). It's never sold, never used for targeted advertising or credit decisions, and never read by people except with your consent, for security (such as investigating abuse), or where the law requires.

• Pages you scan: when you paste an address, our server fetches that page to read its words. The address and the page aren't stored.
• Availability checks: the domain names being checked, from the website or the extension, are sent to Permutica, our own availability service, which checks them using DNS, registry (RDAP) lookups and, when needed, Namecheap's availability API. Only the domain names are sent: no page text, addresses or personal details go with them. Checked domain names and their answers are cached in our server's memory for up to 10 minutes, so the same name isn't looked up twice in a row.
• Analytics: we count visits with Fathom Analytics, which uses no cookies and doesn't collect personal data or track you across sites.
• Abuse prevention: whether you use the website or the extension, your IP address is held in our server's memory for up to 24 hours to enforce limits on how many scans, checks and Register links one visitor can use (per minute for all three, and per hour and per day for scans and checks). It's used only for those limits and to protect the service from abuse (including counting failed lookups per address, so one visitor can't pause checks for everyone), and this copy is never written to disk or a database (signing in to the website keeps one with your session, as described below). Sign-in requests are rate-limited by address in memory too; that entry lapses after a few seconds and is cleared at the next sign-in or when the server restarts.
• Sign-in (optional): if you sign in with Google, we store your name, email address and profile picture from Google, and for each session the IP address and browser it was started from. This is used only to keep you signed in, with cookies that hold the session. Signing out ends the session.
• Errors and request logs: if something fails, a short record of what went wrong is kept in our server logs. It says what kind of failure it was, not which page or domain names were involved. Our hosting provider (Railway) keeps request logs for a limited time, as it does for all sites it hosts; they include IP addresses and the addresses requested, which for Register links include the domain.

When you click Register, or a registrar's name, you go through NameHawk to that registrar (Namecheap, Dynadot or GoDaddy), usually by way of CJ, an affiliate network. If you then register the domain, NameHawk may earn a commission, at no extra cost to you. CJ and the registrar may set cookies to record that, under their own privacy policies. The domain name is passed along so the registrar can show it and, through CJ, so a commission can be matched to it; NameHawk passes on nothing else about you. Like any site you visit, CJ and the registrar see your IP address and browser.

• Turn automatic scanning on or off, or stop it on a particular site, from the extension's popup. It stays off unless you turn it on.
• Clear your finds from the Your finds page, or remove everything by uninstalling the extension.
• Ask us to delete your account and its data by emailing us.

NameHawk isn't directed at children under 13, and we don't knowingly collect their data.

If what we collect changes, this page will change first, with a new date at the top. Questions or requests: hello@namehawk.co.