Updated 30 October 2026
Privacy Policy
Nameward ("we") runs nameward.app. This policy explains what personal data we collect when you use nameward.app, why, and what you can ask us to do with it. Questions: [email protected].
What we collect
| Data | When | Why (legal basis) |
|---|---|---|
| Email address | You sign in, add an email alert channel, or someone invites you to their account | To sign you in and send alerts and summaries you asked for (contract) |
| The domains and hostnames you monitor or scan | You add them or run a free scan | To run the checks (contract; for free scans, legitimate interest in providing the tool you used) |
| IP address and browser user agent | Sign-in, sessions, free scans, the contact form, rate limiting | Security and abuse prevention (legitimate interest) |
| Passkeys: the public key, its name and when it was added and last used | You add a passkey | To sign you in (contract). Fingerprints and face scans never leave your device |
| Alert channel addresses (Slack, Teams, webhook URLs) | You add a channel | To deliver alerts (contract) |
| Delivery records (sent, failed) | We send an alert | To show you whether alerts arrived (contract) |
| Name, email address and message | You use the contact form | To reply to you (legitimate interest) |
The checks themselves only read public information about your domains: DNS records, registration data (RDAP/WHOIS), Certificate Transparency logs and the certificates your servers present. Registration data can include a domain owner's name or email if the registrar publishes it; we show it to you because it's public, and we flag it so you can hide it.
We don't use advertising or analytics trackers, and we don't sell or share your data for marketing.
How long we keep it
- Sign-in links and codes: deleted a day after they expire (15 minutes).
- Sessions: 30 days after your last visit.
- Passkeys: until you remove them or delete your account.
- Invitations to join an account, including the invited address: a day after they expire (7 days), or when the account is deleted.
- Free scans, including the IP address that ran them: 90 days.
- Contact form messages and support emails: two years after our last exchange, so we have the history if you write again.
- Monitoring reports and alert deliveries: 90 days.
- Your account, domains and channels: until you delete them. Deleting a domain deletes its history; deleting your account (Settings → Account) deletes everything in it straight away. Our backups are kept for 30 days, so deleted data is gone from them within 30 days.
- Billing records: kept by our payment provider, Polar, for as long as tax law requires.
Who processes data for us
We use a small number of providers to run the service, listed with their location on the Subprocessors page. When a scan looks up your domain, the domain name (never your personal data) is also sent to the public services that hold the answer: DNS resolvers, domain registries and registrars (RDAP), and Certificate Transparency search services. The contact form is checked by Cloudflare Turnstile to keep out spam bots.
Data is stored on Oracle Cloud Infrastructure servers. Where a provider processes data outside the European Economic Area, we rely on the European Commission's adequacy decisions or standard contractual clauses.
Cookies
We set three cookies, all needed for signing in, and no others. See the Cookie Policy.
Your rights
You can ask us to access, correct, delete or export your personal data, or object to or restrict how we use it. Email [email protected]; we answer within 30 days. You can delete domains and alert channels yourself in the app, and stop the monthly summary from its email or the Alerts page. You can also complain to your data protection authority.
Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect. The date at the top shows the latest version.