Privacy
This page says what the nicheclock website stores about you, and what it does not.
What the site counts
Page views are counted with a small first-party script. When you leave a page it sends:
- the page path, without the query or the part after
#(the filters you pick on the home page live after the#and never leave your browser); - how many seconds the page was visible and how far down you scrolled, in buckets;
- a mobile or desktop flag;
- the kind of site you came from (search, social, AI assistant, direct, internal or other), never the address of that site;
- whether you clicked through to another page here.
We keep daily totals per page. We don't store one row per visitor, and we don't store your IP address, a cookie, a user agent or any identifier. The script reads the user agent only to skip crawlers and does nothing if the browser reports automation.
Cookies and third parties
Browsing the site sets no cookies. It stores nothing in your browser unless you save a niche profile (next section). It loads no third-party scripts, fonts or trackers. The one exception is the key page, /keys: signing in there sets two cookies that are needed for the sign-in and for nothing else (described under API keys and sign-in below). Links to sources and to GitHub take you to their sites, which have their own policies.
Your niche profile
The optional Your niche page keeps a profile (the topics you write about, a country, and anything else you type there) in this browser only, in localStorage under one key. It is never put in the address, so a copied link cannot carry it and the page counter above cannot see it. No profile data leaves your browser: the page downloads the same public data files as every visitor (the page, its scripts, the topic list and one list of Wikipedia pages for your country, all without a query string) and does the matching on your device. Typing a topic, saving, editing, switching profiles and exporting send nothing. The site has no copy of your profile, so it cannot restore it: Export JSON gives you a file to keep. Delete this profile removes it from the browser, and a private window forgets it when it closes. A shared computer keeps it until you delete it.
To check this yourself, open the developer tools, choose Network, and press Show my niche: you will see GET requests for data files and none that carries what you typed.
The three buttons that send something
Three buttons on the Your niche page send one thing to nicheclock, only when you press them. Each sends only its own field, never the rest of the profile and never the field of another button.
| Button | What it sends | What happens next | Limit |
|---|---|---|---|
| Look up a word | the word you typed | nicheclock looks in its own topic list first. A word that is not in it is sent to Wikidata (the word only, not your site or your profile). | 20 a minute from one address |
| Read my site | the address of your site | nicheclock reads robots.txt, one sitemap and up to 8 page titles from that site, with the user agent nicheclock-suggest (what it is and how to block it), and returns a list of topic words. The words are not sent to anyone else. | 3 a minute from one address; one read of the same site a minute; 2,000 reads a day in all |
| Read my channel (shown only when it is switched on) | your YouTube handle | nicheclock asks YouTube for the titles and tags of your latest 50 videos and returns a list of topic words. | 2 a minute from one address; 2,000 units of the free YouTube quota a day for everybody |
The address, the word, the handle, the pages read and the replies are not stored and are not written to any log. The code of these handlers has no logging call, and a test checks that. The limits per address are Cloudflare's rate-limiting feature: the counter for your address lives inside Cloudflare, and nicheclock does not store your address, not even in hashed form. The only counters nicheclock keeps are two daily totals with no caller in them (YouTube quota units used today, site reads today). Cloudflare's own network logs, described below, still see the request as they see any page. AI agents that use the hosted MCP tools with a key send a profile in the call; it is used in memory for that call and dropped.
Network logs
Cloudflare serves the site and keeps its own network logs, which include IP addresses, under its own policies. We don't add to them, and we don't sell or share anything.
The self-hosted software
The nicheclock package sends nothing to us. It runs on your machine, keeps its data in your own directory, and talks only to the sources you enable and the model you configure. Your Search Console data and your model keys stay with you.
API keys and sign-in
The free hosted API and MCP server need a key. You get one by signing in with GitHub at /keys. This is the only place where the site holds personal data about you.
What we ask GitHub for
The sign-in asks for the user:email scope. When you come back from GitHub, the server reads your numeric GitHub id, your GitHub login name and your verified primary email address, once. The GitHub access token is used for those two reads and then thrown away. It is never stored.
What we store
- Per key: your GitHub id, your email address in lower case, a short public key id, the SHA-256 hash of the key, the plan (
free), the dates it was created, last used (updated at most once an hour) and revoked. The key itself is shown once when you create it and is not stored, so we cannot show it again. - Usage counters: per key, per day and per kind of call, the number of requests and the bytes sent back; plus a per-minute request count that is deleted within minutes. We use them to apply the limits and to see whether the service is used.
- Not stored: the contents of your requests and replies, and your IP address (Cloudflare's own network logs, above, still see it). For the profile tools, the profile you send is used in memory for that call and dropped.
Cookies on the key page
Two cookies, both HttpOnly and Secure. nk_oauth holds a random value for 10 minutes while you are at GitHub and is checked when you return, so a forged sign-in cannot be completed. nk_session lasts 1 hour after sign-in and holds your GitHub id, login and email, signed so it cannot be changed. It lives only in your browser; the server keeps no session record. Sign out on the key page deletes it.
Keeping and deleting
We keep key rows and counters while the service runs, including revoked keys, so that a revoked key stays refused. To have the rows tied to your GitHub id or email deleted, write to the address below. You can revoke a key yourself at any time on the key page. We don't sell or share this data, and we don't send you email: your address is used to limit the number of keys per person (2 active keys per email).
Contact: oss@elmrank.com. Last updated 2026-11-03.