Privacy at HashKosh
How HashKosh handles searches, operational records, optional Google services, advertising cookies and your privacy choices.
Feedback and star ratings
Submitted messages, optional names/emails and corrections stay private to the site owner. Only owner-approved star ratings contribute to the public average. Anyone holding your private reference code can read your message, status and the owner's reply; do not share it. Internal notes and email are excluded from that lookup. A one-year HttpOnly browser cookie and hashed quota identifiers help limit abuse and duplicate reviews; raw IP addresses are not stored. Duplicate detection is limited when cookies are cleared or another browser is used. Email notifications are not sent.
Live visitor counter
The footer Supercounters counter loads automatically on public pages. The service receives your IP address, browser/device information and public page URL without query parameters. It runs in a separate sandboxed frame and is disabled on private admin pages. Analytics and advertising consent is separate.
Vocabulary sources
English vocabulary uses the MIT-licensed word-list dictionary with an offline common-language filter from wordfreq. These are not social-media traffic statistics. Hindi topics were prepared separately. The vocabulary selection is available under CC BY-SA 4.0; application code is separate. word-list / Sindre Sorhus · wordfreq / Robyn Speer · Underlying sources and SUBTLEX credits · CC BY-SA 4.0
Optional analytics and advertising
If the operator enables Google Analytics, Tag Manager or AdSense, their scripts load only after you allow optional services. Google may receive device, page-view and cookie information. Your choice is stored in this browser under hashkosh-optional-consent-v1. You can change it near the footer. These integrations are disabled on admin pages.
Google advertising cookies and your choices
When you allow advertising, Google and other third-party ad providers may read or set browser cookies. Ad delivery, measurement and abuse prevention may also use pixels/web beacons, your IP address and device information. Depending on your consent and ad settings, visits to HashKosh or other websites may inform personalized ads.
Use Google Ad Settings to turn off Google's ad personalization, or WebChoices to opt out with other participating providers. Change HashKosh's optional-services choice in the footer. Where Google's consent message is shown, it also provides provider and purpose choices.
Searches and public HashTags
When a valid search is accepted, we store the normalized HashTag and add one to its public search total. A HashTag may become a public page. Do not search for passwords, private identifiers, or information you do not want made public. We do not keep a separate history of your raw search input by default.
What the number means
Activity counts accepted searches, actual page opens and HashTag clicks on HashKosh. It is not unique visitors or social-platform traffic. Search submissions remain stored separately from opens/clicks. Retrying the same request does not add twice.
Short-lived operational records
The application stores a random request identifier and a hash of the normalized request for at least 24 hours so a retried search does not count twice. Shared abuse controls use a secret-key hash derived from the client address supplied by the configured trusted proxy. These application tables do not store the raw address. This reduces direct identification; it does not make the data completely anonymous. Expired operational records are removed by scheduled cleanup. When a trusted client address is unavailable, public search uses a signed random browser cookie lasting up to 24 hours to keep visitor quotas separate. It is HttpOnly, uses Secure over HTTPS, and grants no account access. Site-wide quotas still protect the database when cookies are discarded.
AI-assisted explanations
If AI generation is enabled, the normalized public HashTag is sent to the configured AI provider to prepare an English and Hindi explanation. Validated content is stored and reused. In the separate AI hashtag generator, pressing Generate sends your short description, chosen platform and language to OpenAI for moderation and suggestions. Leave out private information. These generator descriptions and results are not saved as public content or search records in our database. Hashed requester rate-limit records expire after two hours; the shared monthly allowance record expires two days after the next UTC month starts. Local text and wedding generators do not send your input to AI. We do not send an account profile because HashKosh does not offer visitor accounts. Provider processing and retention depend on the service and settings chosen by the operator. In the text generator, pressing Make can add eligible word hashtags to the public library at 0 searches and return related database suggestions. The complete paragraph is not sent to the server and these additions do not automatically start AI jobs.
Your browser and hosting logs
Your language is selected by the page URL. The application does not add fingerprinting or visitor accounts. Optional analytics and advertising services are described above. Your host or reverse proxy may maintain access and security logs under its own configuration. Request headers can be processed for delivery and abuse protection. Copying writes the selected text to your clipboard only when you press Copy.
Private owner account and sharing
Public search does not require an account. The private owner account stores a display name, login email and a salted scrypt password hash. Secure HttpOnly cookies maintain the owner session, which lasts up to 30 days from sign-in without an inactivity timeout. Signing out revokes the session. Administrative actions are recorded in a protected audit log without passwords or content bodies. These operational records remain until operator cleanup or retention changes; access is restricted to authorised operators. Social share links open the chosen provider only when you select them. That provider has its own privacy rules. HashKosh does not embed social tracking SDKs or send messages for you.
Retention and safety
Aggregate HashTag totals and approved public explanations are retained as part of the service. Short-lived retry and abuse records expire independently. Backups and infrastructure logs may follow separate retention periods. Avoid submitting personal or sensitive information to this public search tool.
Questions or a public-content concern
Include the public HashTag URL when contacting the site operator through their published support channel. Never include a password, payment information, or another person's private records. An operator can hide unsuitable content without publishing it further.
Service providers and data destinations
The site uses GoDaddy hosting and a MariaDB database. Hosting/reverse-proxy services deliver and protect pages; selected features may also involve Google, Supercounters, X and AI providers. Providers may receive information needed for their function, such as your description sent to the AI generator or browser connection information sent to advertising services. Providers may process information in other countries. When you follow an external link, that site's privacy policy applies.
Requests about your information
Use the contact form to request access to, correction or removal of information you submitted, or to ask about its use. Include the relevant public URL or your private feedback reference code. The operator may reasonably verify your connection to the information before acting. Applicable rights and exceptions depend on your location and the information involved; some records may need to remain for legal, security or backup reasons. Browser cookies and optional consent can be managed separately.
Children's information and safe use
HashKosh is not designed to solicit children's personal information. Do not enter a child's name, school, address or identifying details in forms, search or AI tools. A parent or guardian concerned that such information was submitted or published can use the private contact form with the relevant URL. Follow applicable local age and parental-permission requirements.
Security, retention and notice updates
Access to private submissions, drafts and owner records is restricted, but no internet service can guarantee complete security. Feedback and audit records are not automatically erased when reviewed; retention depends on operational needs and operator cleanup. You can request removal of your information when no longer needed. Backup copies may remain under separate retention. The updated date identifies this version; the notice will be revised as the service changes.