Data sources

ENABLE word list (public domain): which strings are English words.
google-10000-english (MIT): commonness tiers only.
German, French, Spanish and Italian common words, derived from Google Books Ngram data (CC BY 3.0). Word order only; no frequencies are published.
Spelling dictionaries for German, Spanish, French, Italian, Dutch, Polish, Portuguese, Czech, Croatian, Danish and Romanian from LibreOffice, and for Hungarian, Slovak, Lithuanian, Turkish, Serbian, Swedish, Norwegian, Latvian, Estonian and Slovenian from wooorm/dictionaries, used unmodified under their MPL, BSD, MIT, LGPL and GPL licences.
Place names (countries, cities, towns, regions, islands), deity names, given names and brand names from Wikidata (CC0).
Every live extension from the Public Suffix List (MPL 2.0), used unmodified.
Which generic extensions are brand-only or never opened, from Cobertos/tld-data (MIT), corrected for later launches.
Word lookups for otherwise unexplained names: entries on Wiktionary (linked, not copied) and article titles and short descriptions from Wikipedia and Wikidata (CC0).
Retail sales figures per keyword from NameBio.
Availability from DNS, the registries' RDAP servers listed by IANA, and registrars.

Limits we keep

Every outside source is asked from our server only, never from your browser, and within its rules:

Wikipedia and Wiktionary: one request at a time from the whole service, as Wikimedia's API etiquette asks, identified by a User-Agent with our contact address, with maxlag so we back off when their servers are busy. Each word is asked about once, ever; the answer is kept.
Wikidata: queried only when we rebuild our place, deity and name lists, a few times a year, one query at a time, identified the same way.
NameBio: at most 4 requests a minute, their published limit for the free endpoint, and each keyword's figures are kept for 30 days. Their data is credited wherever it is shown.
Dynadot: one request at a time, at least a second apart (their 60 a minute), and no more than 45 estimates a day against their 50. Estimates are kept for 30 days.
Registries (RDAP): found through IANA's bootstrap list, refreshed daily, never through a third-party proxy. A registered name is not asked about again for a week.