Privacy notice

• Your text is not uploaded. Word clouds are built in your browser, and your projects are stored in your browser on your device. The same goes for an image you use to make a custom shape.
• Accounts hold the minimum. An email address, a name and profile picture if you sign in with Google, your plan, and your editor preferences.
• Payments are handled by Stripe. We never see your card number.
• Analytics are cookieless. We use a first-party analytics tool that sets no cookies, stores no IP addresses and never receives your text.
• You are in control. Download everything we hold, or delete your account and all of it, from Settings › Your data.

Your text and your word clouds. Processed in your browser. Signed-in projects are stored in your browser's local database on your device; the no-sign-up preview is kept only in the browser tab's session storage and goes when the tab's session ends. We do not receive your text. The only exception is CloudSync, described below, which you choose to turn on.

Images for custom shapes (Premium). If you make a custom shape from an image, the image is read and traced in your browser and is never uploaded. Only the traced outline, a list of points, is saved with your project, and it is synced, encrypted, only if you use CloudSync. We do not receive or keep the image.

Your account. When you create an account we hold your email address and, if you sign in with Google, the name and profile picture Google provides. Sign-in is run for us by Auth0, which stores your credentials or your Google identity, and a record of when you signed in. Passwords are never visible to us.

Billing. If you buy Premium or a one-off export, Stripe handles the payment and holds your card details and billing address. We hold Stripe's customer and subscription identifiers, which plan you are on, and which projects have had their watermark removed. Stripe keeps invoices for as long as tax law requires, even after you delete your account.

Preferences. Your editor preferences (fonts, sizes and colour palettes) are stored on our servers against your account so that they follow you between browsers.

CloudSync (Premium, optional). If you connect Google Drive, your projects are encrypted in your browser and saved to a folder that WordCloud+ creates in your own Google Drive. The encryption keys are generated and protected by a key-management service; we do not have access to your Drive, and the copy in Drive is unreadable without your keys. You can disconnect Drive at any time in Settings.

Usage analytics. We record page views and product events (for example that a project was created, how many words it contained and which export format was chosen) using a first-party analytics tool that sets no cookies, honours your browser's Do Not Track setting and does not store your IP address. Events never include your text. Where you are signed in, events are linked to your account so that we can see how the product is used by plan.

Server logs. Like every website, our servers keep short-lived access logs containing your IP address, browser type and the pages requested, used only for security and troubleshooting.

Support. If you email us, we keep the correspondence so that we can help you and refer back to it.

• to provide the service: signing you in, remembering your preferences, syncing your projects if you ask us to, and removing the watermark you have paid for;
• to take payment and keep the records the law requires;
• to understand how the product is used, so that we can improve it;
• to keep the service secure and to prevent abuse;
• to answer you when you contact us.

We do not sell personal information, we do not use it for advertising, and we do not send marketing email. Emails about your account and your payments are sent when they are needed.

Under the UK GDPR and the GDPR we rely on: performance of a contract for the account, the plans and the payments; our legitimate interests in improving and securing the service for the analytics and the server logs, which we have balanced against your interests by using cookieless analytics and short log retention; consent for CloudSync, which you give by connecting Google Drive and can withdraw by disconnecting it; and legal obligation for the tax records that Stripe and we must keep.

We share personal information only with the providers that run parts of the service for us, and only what each needs:

• Auth0 (Okta) for sign-in: your email address, and your Google identity if you use it.
• Stripe for payments: your email address and what you bought. Card details go to Stripe directly and never pass through us.
• Google, only if you turn on CloudSync: your encrypted projects go to your own Google Drive under a permission limited to files WordCloud+ creates. Separately, exporting a PNG or JPEG fetches font files through the Google Fonts service, which sees your IP address as any download does.
• Amazon Web Services for the key management behind CloudSync and for storing your editor preferences.
• GitHub, from which the app fetches the default stop word list for languages other than English; GitHub sees the request, not your text.

Our own servers, including the analytics tool, run on infrastructure we operate in the United Kingdom. We will disclose personal information where the law requires it, and if the business is sold or transferred the information would pass to the new owner under this notice.

WordCloud+ sets only strictly necessary cookies: the session cookies that keep you signed in, and a short-lived cookie during the Google Drive connection step. They are first-party and HttpOnly, and they are exempt from the consent requirements of PECR and the UK GDPR, which is why the site shows no cookie banner. We set no advertising, analytics or cross-site tracking cookies. Stripe sets its own cookies on its checkout pages, not on ours.

Your projects, drafts and some interface preferences are kept in your browser's own storage (IndexedDB, localStorage and sessionStorage). That is where your work lives; it is not sent to us and it is not a tracking mechanism. Clearing your browser's site data for wordcloudplus.com deletes it, so export anything important first. This section is our complete cookie notice.

The service is hosted in the United Kingdom. Auth0 stores account data in the European Union. Amazon Web Services stores your preferences and key material in the European Union. Stripe and Google process information in the United States and elsewhere under the standard contractual clauses and the UK's international data transfer addendum, so your information stays protected wherever they handle it.

Account data, preferences and billing identifiers are kept while you have an account, and deleted when you delete it. Server logs are kept for a short period, measured in weeks, and then discarded. Analytics data is kept in aggregate form without identifying you once your account is gone. Stripe keeps invoices for the period that tax law requires. Support emails are kept for as long as they are useful to help you.

Everything travels over HTTPS. Sign-in is delegated to Auth0 and payments to Stripe, so the most sensitive information never reaches our servers. CloudSync encrypts your projects before they leave your browser. Access to our systems is limited to the people who run the service. No system is perfectly secure, so if you have reason to think your account has been accessed by someone else, tell us at support@wordcloudplus.com and change your password.

WordCloud+ has no minimum age, and it is used in schools. The no-sign-up preview collects no personal information at all. An account holds an email address, so a child under 13 should ask a parent, guardian or teacher before creating one; the usual arrangement in a class is that the teacher holds the account. If we learn that we hold an account for a child under 13 without that permission, we will delete it. Teachers analysing students' writing should remove names before pasting; the classroom page explains how.

Under the UK GDPR and the GDPR you can ask to see the personal information we hold about you, have it corrected or deleted, restrict or object to our processing of it, and receive a copy in a portable format. Where we rely on consent you can withdraw it at any time. You can exercise all of these yourself from Settings › Your data or by emailing support@wordcloudplus.com; we reply within a month.

If you are unhappy with how we have handled your information you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live. Residents of some countries and US states have additional rights under local law; email us and we will honour them.

Settings › Your data has two buttons. Download gives you one file containing everything we hold on our servers about you, merged with the projects in the browser you are using. Delete my account cancels any subscription, deletes our copy of your preferences and your sign-in record, and clears the projects from that browser, in that order, so that a failure part-way leaves your account intact rather than half-deleted. Projects in other browsers and anything in your own Google Drive are unaffected, because we never had them. If you cannot sign in, email support@wordcloudplus.com from the address on the account and we will do it for you.

We will update this notice when the product or the law changes. The date at the top shows the last revision. If a change matters to you, for example a new provider or a new use of your information, we will say so on the site or by email before it takes effect.

Poynter Services Limited is the data controller. Email support@wordcloudplus.com, or write to 38 South View Road, Carlton, Nottingham NG4 3QL, United Kingdom.