Amazon Keyword Tool takes a search phrase you type, asks Amazon what people search for around it, and counts how many products already compete for each of those keywords.
Your search goes to Amazon — that's where the suggestions come from. It goes nowhere else: no account, no server of ours, no third party. Those requests carry the Amazon cookies your browser already holds for that Amazon site, exactly as a normal visit to that site does, and the reason is explained in section 3.4.
There is no account and no sign-up. We run no server that receives your keywords or your searches (one page on our site opens once when you install — section 3.7), and we have no analytics, telemetry or crash reporting of any kind. What the extension saves — your keyword table, a cache of Amazon's answers, one interface flag and the id of its own tab — it saves in your own browser's storage on your computer, where it stays under your control. Section 4 says how long each part lives.
Listing Keyword Tool ("we", "us"), publisher of Amazon Keyword Tool in the Chrome Web Store. Questions about this policy: support@listingkeywordtool.com.
You open the extension from its toolbar icon; it opens in its own tab. You type one search phrase (the "seed"), pick an Amazon marketplace and a department, and press the button. The extension then asks Amazon's search-suggestion service what shoppers search for around your phrase, and — when you ask it to — loads Amazon search-result pages to read how many products come back for each keyword. The result is a table you can sort, filter and export to CSV.
That is the extension's entire single purpose. Everything below follows from it.
The extension makes exactly two kinds of network request for its own work, and both go to Amazon. Once, at installation, it also opens a page on our website — section 3.7.
GET https://www.amazon.<marketplace>/suggestions?mid=…&alias=<department>&prefix=<your phrase>[&suffix=…]Your phrase is sent as the prefix parameter — and, in the brand variation described below, as the suffix parameter instead. This is the request that produces keywords: the suggestions are Amazon's, so the phrase has to reach Amazon for them to exist.
The same request is repeated with variations built from your phrase:
suffix parameter;The variations are derived from what you typed and from what Amazon has already returned; nothing else of yours is added to them.
One press starts many requests, not one. A full-depth run asks Amazon's suggestion service on the order of a hundred times, and counting loads one search-result page per keyword, a few at a time, over the following minutes. They are ordinary requests made by your browser, paced by the extension; nothing is queued on any server of ours, because there is none.
GET https://www.amazon.<marketplace>/s?k=<keyword>[&i=<department>]Only keywords already in your table are sent here: your own seed phrase and the suggestions Amazon itself returned. The response is read as a stream and the connection is dropped as soon as the number is found, so at most about 600 KB of the page is read. The page itself is not stored — only the number and a note of how it was obtained (an exact figure from the page's metadata, or a rounded one read off the page layout).
Requests can only go to the ten Amazon domains the extension declares in its manifest:
www.amazon.com, www.amazon.co.uk, www.amazon.de, www.amazon.fr, www.amazon.es, www.amazon.it, www.amazon.ca, www.amazon.com.au, www.amazon.com.br, www.amazon.in
The host is chosen from a fixed table of marketplaces inside the extension; there is no code path that can put any other address into a request. The extension sets no custom headers, sends no request body, and adds nothing of its own to the request beyond the parameters described above.
Both requests are made with credentials included. In practice this means Chrome attaches the cookies you already have for that Amazon domain (session and preference cookies, and, if you are signed in to Amazon, your sign-in cookies). The request therefore reaches Amazon as coming from your browser and, if you are signed in, from your signed-in session.
Why: Amazon sits behind a bot-management service. A stream of cookie-less requests gets served a bot-check page instead of results — we measured this, and it is not a rare edge case: a single cookie-less request can succeed, but a run of them does not. Without cookies the extension simply does not work.
What this does not mean: the extension does not read, copy, store or forward those cookies. It does not request Chrome's cookies permission, and it does not touch document.cookie anywhere. Attaching them is the browser's doing, they go only to the Amazon domain that owns them, and their values are not visible to the extension's code.
Once a request reaches Amazon, it is Amazon's to handle under Amazon's own privacy policy and terms. We have no visibility into and no control over that. Amazon is the only third party involved in this extension.
The extension sends your data to no server of ours — we operate none that receives it. Apart from the one install-time page described in section 3.7, there is no analytics endpoint, no telemetry, no crash reporter, no advertising or tracking pixel, no external font or CDN, and no third-party SDK anywhere in the extension. Except for those two kinds of request, sent to the ten Amazon domains listed above, the extension makes no outbound request at all — the code contains no other network call of any kind, and it never sends anything to our own site.
The extension also has no scheduled background activity of its own: the only Chrome permission it holds is storage, so it cannot even register a background alarm. It does nothing while you are not using it.
When you install the extension, Chrome opens one page on our own website: https://listingkeywordtool.com/welcome. It shows where the toolbar icon is and how to pin it — nothing else. It opens once, on installation only, never on updates.
Because that page is on our site rather than inside the extension, our web host receives an ordinary web request for it: your IP address, your browser's user agent and the time, exactly as any website you visit receives. That is the one moment the extension causes your browser to contact us, and it happens before you have typed anything.
What is not in it: the address carries no identifier, no installation id, no version and no campaign tags — it is the bare address above, the same for everyone. The page itself loads no script, no analytics, no tracking pixel and no external resource. We do not count installs, and if we ever decide to, this policy changes first.
What never travels with it: your search phrases, your keyword table and everything described in section 4 stay on your device. The install page has no access to them.
The extension saves four kinds of entry in your browser's local extension storage on this device, plus one number in session storage.
| What | Contains | How long it lives |
|---|---|---|
| Your current work session | Your seed phrase, the chosen marketplace and department, the options you picked, every keyword row collected (keyword, its position in Amazon's suggestions, its parent keyword, depth, source, how many times it was seen, its result count) and the demand / competition / opportunity figures computed from them, plus run status | No expiry. It stays until you clear it or remove the extension, so closing the tab does not lose your work |
| Cache of Amazon suggestions | Keyed by marketplace, department and the phrase asked about | Reused for at most 24 hours; the entry itself is deleted when a later run sweeps it |
| Cache of competing-product counts | Keyed by marketplace, department and keyword | An exact number from page metadata is reused for at most 24 hours; a rounded number read off the page layout, for at most 1 hour. Deletion works the same way |
| One interface flag | A single true/false value recording that you have already seen a competition number, so the extension stops prompting you about that step | No expiry; it is not removed by any housekeeping |
| The id of the extension's own tab (session storage) | A number, so a second click on the icon reuses that tab instead of opening another. Not an address and not a title | Gone when the browser restarts |
An important distinction about the caches. The 24-hour and 1-hour figures decide how long a cached answer may still be used. They are not deletion timers: an expired entry stops being reused, but the entry itself is removed only when housekeeping runs — at the start of a later keyword run or counting run. If you never start another run, expired entries stay on disk until you remove the extension.
Your typed phrase appears in two of these places: as part of the cache key for suggestions, and as the seed field of the saved session.
If the browser's storage quota is reached, the extension drops expired entries or the older half of the cache, and if that is not enough it drops the whole cache. Housekeeping never touches your saved session or the interface flag.
Chrome's own account synchronisation is not used. The extension writes nothing to chrome.storage.sync — the one area Chrome would upload to your Google account — so none of the above is synced anywhere. It also does not use localStorage, sessionStorage or IndexedDB.
tabs, history or webNavigation permission.eval, no dynamically constructed functions and no decoded addresses.The export is assembled in the page and handed to Chrome, which saves it to your downloads folder like any other download. Nothing is uploaded, and the extension does not hold Chrome's downloads permission. The suggested file name is derived from your search phrase, so your phrase will appear in the name of the saved file.
The file contains your keyword table in thirteen columns: keyword, position, depth, hits, parent, source, result count, broadened flag, demand, competition score, opportunity, and two honesty notes about how well the numbers cross-checked and whether any of them are rounded.
One safety detail: cells beginning with =, +, -, @, tab or carriage return are prefixed with an apostrophe — the standard mitigation against spreadsheet formula injection.
storage — to keep your session and the cache described in section 4 on your own device. It is the extension's only Chrome API permission.Answering the Chrome Web Store's data-use categories, in the store's own words:
Our use of data obtained through the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements:
We do not receive your data, so for most of this policy there is no processing by us to assign a legal basis to. Where the extension acts on your device — sending the phrase you typed to the Amazon marketplace you selected, and saving the results locally — it does so to perform the task you asked it to perform (Article 6(1)(b) GDPR: performance of a contract, or steps taken at your request).
We do not rely on legitimate interests for advertising, profiling, audience measurement or analytics, because the extension does none of those things.
The Amazon marketplace you pick decides where the request goes. Choosing amazon.com sends your search to Amazon's US storefront; choosing amazon.de sends it to Amazon's German one. If that means your phrase leaves your country, it is because you selected that storefront — the transfer is the operation you asked for, and the extension offers no other destination.
What Amazon does with the request once it arrives is governed by Amazon's own privacy policy, not this one. We transfer nothing ourselves, because we receive nothing.
Everything the extension stores stays in your browser's own extension storage on your device, protected by your operating system, your browser profile and whatever disk encryption you use. We keep no copy, run no server that receives it and hold no backups, so there is no database of ours that could be breached. Requests to Amazon are made over HTTPS.
No safeguard is absolute. We cannot protect data on a device that is compromised, and we have no control over the security of your Amazon account.
Because we hold no copy of anything, a request to us to access, correct, export or delete your data would have nothing to act on. Control sits with you, on your device:
chrome://extensions → Remove). Chrome deletes an extension's storage with it. There is deliberately no in-product "wipe everything" button; uninstalling is the complete erase.If you are in the EEA, the UK, California or a comparable jurisdiction and want to exercise a statutory right anyway, write to support@listingkeywordtool.com and we will answer — the answer will normally be that we hold nothing about you.
Whatever Amazon has recorded about requests made from your browser is subject to Amazon's own policy and is requested from Amazon, not from us.
The extension is a tool for people selling on Amazon, and is not directed at children. We receive no data about anyone, of any age — see section 8 for what the extension itself reads and stores on your own device.
If the extension's data behaviour changes, this page changes with it, and the effective date at the top is updated. Material changes will also be reflected in the Chrome Web Store listing's privacy disclosures, since those must match the shipped build.
Listing Keyword Tool
support@listingkeywordtool.com