Privacy

What we collect

Your email address

Sign-in works by emailed link, so the address is the account. There are no passwords. Domduck holds no password hash for you, because no code path could use one.

The domains you track

Your list is yours. Only your account can see it.

Session records

When you sign in, Domduck writes a session row holding the IP address and browser user agent of that sign-in. That row is what lets you see and end your own sessions.

Domains typed into the public checker

Anyone can check a domain on the home page without an account. Domduck records the reading, because a reading is history worth keeping and we cannot recover it later.

What we do not collect

No analytics. No advertising or advertising identifiers. No third-party scripts of any kind. No session recording, no heatmaps, no fingerprinting. No payment details, because the product costs nothing.

You can confirm the first three yourself: load any page and read the network panel. Every request goes to domduck.com.

Cookies

One cookie, set after you sign in, holding your session. It is first party and your account needs it to work. There is no cookie banner because there is nothing to consent to.

What is public

Two things, and both are deliberate.

The home page shows a strip of domains recently added by people using Domduck. It reads the list of names people entered, never anyone’s tracked list. So it can show that somebody entered a domain, and never who entered it or who watches it.

A badge is public for the domain you put it on, and only for that domain. You choose whether to place one.

Who else sees your data

Your email provider and ours

f9mail, an in-house mail platform, delivers sign-in links and relays them through Cloudflare. It receives your address and the link.

Cloudflare

Traffic to domduck.com passes through Cloudflare, so it sees request metadata the way any CDN does.

Domain data sources

When Domduck reads a domain, the name goes to the source we query. Ahrefs supplies the rating. Tranco supplies the rank. The domain’s own registry answers RDAP, and the domain’s own server answers for the certificate and robots.txt. Those requests carry the domain name and nothing about you.

Domduck does not sell data and does not share your list with anyone.

How long we keep it

Domduck keeps readings about domains permanently. That is the product.

Domduck keeps account data while the account exists. Ask, and we delete it along with your tracked list. Readings already collected about a public domain stay, because they are observations about a public name and not about you.

Your rights

Ask for a copy of your data and you get it as dated rows, not a proprietary format. Ask for deletion and we delete it. Write to privacy@domduck.com.

Changes

Material changes land on the changelog before they take effect here.