Last updated: August 6, 2026 · Effective: August 6, 2026
Introduction
Welcome to Domain Scout (“we,” “our,” or “us”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website domainscout.co and use our services.
By using Domain Scout, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.
1. Information We Collect
1.1 Information You Provide
We collect information you voluntarily provide when you:
Create an account (name, email address, password)
Subscribe to our paid plans (billing information processed by Stripe)
Contact us for support (email, name, message content)
Set up alerts and watchlists (domain names you track, free-text notes you attach to watchlist entries, keyword and exclude-keyword filters, notification settings, and any webhook URL you configure for alert delivery)
Complete your profile (optional: phone number)
1.2 Information Generated by Your Account
We also store the following, which is created by the service rather than typed in by you:
Google account identifiers: If you sign in with Google, we store the Google account ID and the URL of your Google profile picture (see section 1.4)
Stripe customer ID: The identifier Stripe assigns to you when you start a subscription
Subscription state: Your plan tier and whether your subscription is active
Email verification state: Whether you have confirmed your email address
1.3 Automatically Collected Information
Different parties collect different things. To be specific about who collects what:
Our backend: Your IP address, which our servers use to apply rate limits and to key request quotas for signed-out visitors. We do not store your browser's User-Agent string.
Our hosting providers: Standard server request and error logs, generated and retained by Fly.io and Cloudflare under their own policies. We do not run a separate crash-reporting service.
Our analytics providers: Google Analytics and DataFast collect page views, referring URLs, approximate location derived from IP, and device and browser characteristics. This happens in your browser, not on our servers. See section 4.1.
Stored against your account: The domains you search for, view, watchlist, or set alerts on.
1.4 Third-Party Authentication
If you sign in using Google OAuth, Google sends us your email address, your name, your Google account ID, and the URL of your Google profile picture. We store all four. Whether your email address is verified with Google is also checked at sign-in.
2. How We Use Your Information
We use the collected information for the following purposes:
Service Delivery: Provide, maintain, and improve Domain Scout features
Account Management: Create and manage your account, authenticate users
Personalization: Customize content, recommendations, and alerts based on your preferences
Communication: Send service updates, security alerts, administrative messages, and marketing (with consent)
Payment Processing: Process subscription payments via Stripe (we do not store credit card numbers)
Analytics: Analyze usage patterns to improve our services and user experience
Security: Detect and prevent fraud, abuse, and security incidents
Legal Compliance: Comply with legal obligations and respond to lawful requests
3. Cookies and Tracking Technologies
3.1 What Are Cookies?
Cookies are small text files stored on your device that help us provide and improve our services.
3.2 Cookies We Set
access_token — an HttpOnly session cookie set by our backend when you sign in. It is what keeps you signed in, and it cannot be disabled without signing out.
CSRF token — a short-lived cookie readable by our own JavaScript, used to block cross-site request forgery. It cannot be disabled.
3.3 Cookies Set by Third Parties
Google Analytics (_ga and related): The Google Analytics tag loads on every page of this site, including before you have interacted with the consent banner. Choosing “Decline” sends Google a signal to deny analytics and advertising storage from that point onward. It does not remove cookies that were already set, and it does not stop the tag loading on later visits.
DataFast: A site-analytics script loaded on every page. See section 4.1.
3.4 Data Stored in Your Browser (localStorage)
Separately from cookies, we store a small amount of data in your browser's localStorage. It is never sent to our servers:
cookie_consent and cookie_consent_date — whether you accepted or declined on the consent banner, and when
ds_has_session — a flag recording that you signed in, so the app knows whether to attempt to restore your session on the next page load
theme — whether you selected light or dark mode
3.5 Managing Cookies
Our consent banner offers a single Accept or Decline choice; there are no per-category cookie preferences and no cookie controls in your account settings. Beyond that banner, you can block or delete cookies and clear localStorage through your browser settings.
Note: blocking the session and CSRF cookies described in section 3.2 will prevent you from signing in to Domain Scout.
4. Information Sharing and Disclosure
We do not sell your personal information. We may share your information only in the following circumstances:
4.1 Service Providers
Supabase: Database hosting and authentication. Holds your account record and everything stored against it
Stripe: Payment processing. Receives your email address, your name, and your Domain Scout user ID when a subscription is created, in addition to the card details you enter directly with Stripe (subject to Stripe's privacy policy)
Fly.io: Backend application hosting. Receives your IP address as part of ordinary request handling
Cloudflare: Hosts the Domain Scout frontend (Cloudflare Pages) and provides CDN and DDoS protection. Receives your IP address for every page you load
Google (OAuth): Optional sign-in. If you use it, Google sends us your email, name, Google account ID, and profile picture URL
Google Analytics 4: Site analytics (property G-27TY07XQ4X). The tag loads on every page and sets _ga cookies. Receives your IP address, page views, and device and browser characteristics. See section 3.3
DataFast: Site analytics. A script loaded on every page that reports page views and referrers, and receives your IP address
Google Fonts: The Inter typeface is loaded from Google's font CDN on every page, so Google receives your IP address and the fact that you loaded a Domain Scout page even if you never sign in
SendGrid: Transactional email delivery. Receives your email address in order to send account emails, domain alerts, and digests
OpenAI/Gemini: AI-powered domain analysis (domain names only, no personal data)
PostHog: Product analytics. Usage events are associated with your account once you sign in, so your activity is linked to your identity rather than anonymous
If you configure a webhook URL for alert delivery, we send alert contents to whatever server you name. Where that data goes after that is outside our control.
4.2 Legal Requirements
We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
5. Data Security
We implement industry-standard security measures to protect your personal information:
Encryption in transit: HTTPS/TLS is enforced on all endpoints
Encryption at rest: Provided by Supabase, our database host. Domain Scout does not add a second layer of application-level encryption on top of it
Authentication: Passwords are hashed by Supabase, our authentication provider. Sessions use signed tokens delivered in an HttpOnly cookie
Rate limiting: Registration is limited to 3 requests per minute and login to 5 per minute. Password-reset requests are limited to 3 per hour, password-reset confirmations to 10 per hour, email verification to 10 per hour, and verification resends to 5 per hour. General API requests are limited to 5 per minute on the free tier, 120 per minute on paid tiers, and 100 per minute for signed-out visitors
Isolation of your data: Every query that reads or writes your records is filtered by your user ID at the application layer
Dependency scanning: Automated dependency vulnerability and secret scanning runs on every change and weekly (see our Security page )
Despite our efforts, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but continuously work to improve our protections.
5.1 Data Breach Notification
We do not operate a dedicated intrusion-detection or security-alerting system. We would most likely learn of a breach from one of our infrastructure providers, from a security researcher, or from an affected user. If we become aware of a breach affecting your personal information, we will:
Investigation: Investigate the breach on becoming aware of it
Contain the Breach: Take immediate steps to contain and mitigate the impact
User Notification: Notify affected users without undue delay where the law requires it
Regulatory Notification: Report to relevant data protection authorities within the deadlines set by applicable law (for GDPR, within 72 hours of becoming aware of a notifiable breach)
Transparency: Provide clear information about what data was affected, when it occurred, and steps we're taking
If you believe your account has been compromised, contact us immediately at support@domainscout.co . We will assist you in securing your account and investigating the issue.
6. Data Retention
We want to be direct about this: Domain Scout does not currently run any automated data-purge job. Nothing you give us is deleted on a schedule.
Account data: Retained indefinitely until you ask us to delete it (see section 6.1)
Watchlists, alerts, and alert history: Retained indefinitely until you delete them in the app or ask us to delete your account
Payment records: Held by Stripe under Stripe's own retention policy. We keep the Stripe customer ID and subscription state on your account record. Records needed for tax and accounting are retained for as long as the law requires
Server logs: Generated and retained by Fly.io and Cloudflare under their own retention policies, not ours
Analytics data: Held by Google Analytics, DataFast, and PostHog under their own retention settings. We do not run any anonymization process of our own
6.1 Deleting Your Account
There is no self-service delete button today. To have your account and its data deleted, email support@domainscout.co from the address on your account with “Delete my account” in the subject line. We handle these requests manually. Data held by the third-party processors listed in section 4.1 is deleted according to their own processes, which we do not control.
7. Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal information:
7.1 GDPR Rights (EU/EEA/UK)
Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data (“right to be forgotten”)
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a portable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent for marketing communications
We process your personal data based on the following legal grounds:
7.2 CCPA Rights (California)
Right to Know: Know what personal information is collected and how it's used
Right to Delete: Request deletion of your personal information
Right to Opt-Out: Opt-out of the sale of personal information (we don't sell data)
Right to Non-Discrimination: Equal service regardless of privacy choices
7.3 Exercising Your Rights
To exercise any of these rights, contact us at support@domainscout.co with “Privacy Request” in the subject line. Requests are handled manually. We will respond within the period required by the law that applies to you — one month under GDPR, and 45 days under the CCPA, in each case extendable where that law permits.
8. Children's Privacy
Domain Scout is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately, and we will delete it.
9. International Data Transfers
Your information may be transferred to and processed in the United States or other countries where our service providers operate. By using Domain Scout, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws.
In practice this means the United States: every service provider named in section 4.1 is US-based, and your data is processed there. If you would like to know the current transfer-safeguard status for a specific provider, email support@domainscout.co and we will tell you what is in place.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will post the updated policy on this page with a new “Last updated” date. We do not currently send an email when the policy changes, so please check this page if that matters to you.
Your continued use of Domain Scout after changes become effective constitutes acceptance of the updated Privacy Policy.
11. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: support@domainscout.co
Website: domainscout.co
For EU/EEA residents: You have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.