Privacy Policy

Data we store

• Email — for login and sending verification codes
• Password — stored as a PBKDF2 hash (never in plain form)
• Subdomain & DNS target — subdomain name, record type, and destination you claim
• Created at — for audit

We do not store IP addresses in long-term storage. Rate limiting uses temporary storage that expires automatically.

Cookies

One cookie: sid — a login session token (HttpOnly, Secure, 7 days). No ad or third-party tracking cookies.

Email

We only send OTP verification emails and account administration emails. No marketing — you will never receive promotions from us.

Delete your data

Want your account and subdomains deleted? Reach out via the contact on the About page — we will process it.

Third parties

The service runs on Cloudflare (DNS, hosting, security) and sends email via SendPulse/Resend. Both process data under their own privacy policies, only as much as needed to run this service.