Lookups
When you look up a domain, the domain name is sent from our server to public sources: registry RDAP and WHOIS servers, public DNS resolvers, Team Cymru, the regional internet registries, Certificate Transparency search services, and the website of the domain itself. Those services see our server, not you. Results are kept in server memory for a few minutes so that repeated lookups do not hit the sources again, and are then discarded.
Your IP address
Your IP address is used in server memory to limit how many lookups one connection can run per minute and hour. It is not written to a database and is gone when the server restarts. If the hosting platform tells us the country of a request, a counter for that country is increased for the "lookup activity" globe. The counter holds a country code and a number: no IP address, no domain, no time of an individual request.
The "What is my IP" page reads your address from the request to show it to you and looks up its network operator. It is not stored and not counted.
Accounts
The workspace requires an account. Accounts are handled by Supabase, our authentication and database provider: it stores your email address, the name you enter, a salted hash of your password (we never see the password itself) and the times you signed up and last signed in. A confirmation email is sent to the address you register. You can ask for your account to be deleted. You can also delete the account yourself in the workspace under Settings, after entering your password again. This removes your sign-in, profile, portfolio, watches, notifications and settings. Offers and agreements you took part in are also the other party's record: they stay, without your name or any link to you, and the same applies to entries in the administrators' audit log. Deletion is refused while an offer is pending or an agreement is open, so that the other party is not left without an outcome. In Settings you can change the display name that is shown on your listings and the language of our e-mails, and you can change your e-mail address; the new address replaces the old one only after you confirm it from the message we send.
Workspace data
Your portfolio (domains, notes, renewal details, reminder settings), watches, notifications, collections, saved views and settings are stored in your account at Supabase, in tables only your account can read. A copy is kept in your browser's local storage so the workspace opens quickly. Marketplace offers are still kept in the browser only. No payment data is collected.
If you add a phone number, it is stored by the authentication service and used only to verify you and to secure your account; it is never shown on listings. If you turn on two-step verification, the authenticator secret is held by the authentication service, not by us.
Cookies and tracking
The public pages set no cookies of their own. When you sign in, a session cookie is set so that you stay signed in; it is used for nothing else and is removed when you sign out. Your colour theme and workspace data are kept in local storage. Visit measurement with Google Analytics is optional: its script is loaded, its cookies are set and usage data is sent to Google only after you choose “Allow analytics”, and you can change that under “Cookie options” at the bottom of every page. There are no advertising pixels or third-party fonts: fonts, images and all other scripts are served from this site.
Data about domains
Lookup results show public registration, DNS and certificate data. Registration contact blocks are not read from WHOIS at all; only registry-published fields such as registrar, dates, status and nameservers are shown, and RDAP data arrives already redacted by the registry. To correct registration data, contact the registrar of the domain. When you use "Share this report", the report as our server observed it is stored with the tool name, the domain, the page language and, if you are signed in, your account id, under an unguessable link. Anyone who has the link can open it. The snapshot holds public lookup data only and is deleted 30 days after it was created.