Privacy

What we store, why we store it, and how to get it back or get rid of it. Last updated 6 October 2026. Questions or requests go to hello@domainators.io.

What we store

If you have an account, we hold:

Your email address, because it is how you sign in and how alerts reach you.
A display name, if you enter one. It is optional.
The keywords you watch and the domain names you tell us you own, together with what our checks found about those names and when.
Your scans, your notification preferences, and your API keys. Keys are stored as a hash, so we cannot read one back to you and neither can anybody who obtains the database.
A billing customer identifier from Polar, so the billing portal can be opened. We never see or store your card details.

Separately from any account, the domain names a scan found with no registration, on the website or through ChatGPT, are asked about again at the public registry 7, 30 and 90 days later, to measure how quickly names in a field are taken. That record holds the names, their topic, the registry’s answers and dates, with no link to you, your scan or what you searched for.

Without an account we store no personal record about you. The public pages do run the analytics described under Cookies below, which counts visits and does not identify you to us by name.

Why we store it

To run the thing you asked for: to sign you in, to watch the names you added, to send the alerts you turned on, and to give you the plan you are paying for. We do not build a profile, we do not sell or share anything to anybody for advertising, and no third party is given your data to use for their own purposes.

Cookies

Two are necessary. A sign in session cookie, without which you cannot stay signed in. And a short lived cookie that remembers which plan you clicked when you are sent to sign in first, so that choice is not lost on the way back.

Two are analytics. We use Google Analytics to count visits and see which pages people read, and it sets cookies named _ga and _ga_ followed by a property identifier. They hold a random identifier so a second visit from the same browser is not counted as a new person. They last up to two years unless you clear them.

We have turned off the parts of Google Analytics that make it an advertising product: no Google Signals, no ad personalisation, and IP addresses are anonymised. We do not run ads, we do not sell anything to anybody, and nothing here is used to follow you to other sites.

There is no banner asking you to accept this, which is a deliberate choice and not an oversight. We would rather state it plainly on the page you are reading than put a dialogue in front of every visitor. If you would rather not be counted, block cookies for this site in your browser, use a private window, or install Google’s own opt out extension. Nothing on the site behaves differently if you do.

Connected apps, such as ChatGPT

You can connect your Domainators account to ChatGPT. Nothing is connected unless you approve it on our site, and this section only applies once you have.

What we receive. Only what a tool is given to work with: a topic or idea you describe, a domain name, the extensions to check, and similar inputs. We never receive your ChatGPT conversation. When you are connected we also receive a sign in token that tells us which Domainators account is asking.
What we store. Name candidate scans you run through ChatGPT are saved to your scan history, with the words you scanned for, exactly as a scan on the website is. Research questions, name assessments and registry checks are answered and not stored against your account. Supabase keeps a record of the connection itself: which app, the permission granted and when.
What ChatGPT receives from us. The answers to the tools it calls, and for the account tool, your account id, plan, trial end date and research freshness. Never your email address, billing details or API keys. ChatGPT is run by OpenAI, which handles what it receives under its own privacy policy.
Limits and faults. Request counts for rate limiting are kept for a short time in Upstash, keyed to your account, or to your address for research without an account. A fault is logged on our host so we can fix it; the log records the fault, not your inputs.
How long. Saved scans follow the rest of your account, as described below. The connection lasts until you remove it.
Disconnecting. Use Disconnect under Connected apps in Settings, Security, or remove the connection in ChatGPT. Access stops at ChatGPT’s next request. Log out everywhere and a password change also disconnect it. Closing your account removes the connection along with everything else.

Who else processes it

We use a small number of services to run the product. Each is given only what it needs, and each processes it on our instructions.

Supabase hosts the database and handles sign in.
Resend sends the alert and digest emails, so it processes your address and the contents of those emails.
Polar is the merchant of record for subscriptions. They take the payment, hold the card details, issue the receipt and keep the invoice records the law requires of them.
Upstash holds short lived rate limiting counters keyed to an account or an address.
Google provides the analytics described above, which means it processes your IP address and the pages you visited. The advertising features are turned off.
Hostinger hosts the site itself.

Some of these operate in the United States. Where your data is transferred there, it is done under the transfer terms those providers publish.

How long we keep it

While you have an account, and for twenty four months after it goes quiet. An account with no sign in and no activity for twenty four months is deleted, with an email first so you can keep it if you want it.

Public forecasts and their outcomes are permanent by design, because the record is the product and a record that can be edited is not one. Nothing in it identifies a person: it is about topics and domain names, never about who looked at them.

Getting it back, or getting rid of it

You can close your account yourself in settings, and it takes effect immediately. Your domains, watchlist, name history, keys and email address are removed from our database and cannot be recovered afterwards. Polar keeps its own invoice records, because a merchant of record is required to.

You can download a copy of everything we hold about you from settings, without asking us: your profile and preferences, the domains you added with the verdicts and the evidence behind them, your watchlist and the alerts we sent about it, the findings we recorded against those names, the scans you ran, and your API keys by name. Your keys themselves are not included because we store only a hash of each one, so there is nothing to return.

To correct something, or to object to a particular use, write to hello@domainators.io and we will answer within thirty days.

If you think we have handled your data badly, you can complain to the data protection authority where you live.

Children

Domainators is a tool for people buying and building on domain names. It is not intended for anybody under sixteen, and we do not knowingly hold data about a child.

Changes

If we change this page in a way that affects what we do with your data, we will email account holders before it takes effect.