Privacy policy

dotnotfound is run by Island AI Lab Inc. (“we”). This page explains what the service collects, why, who else handles it, and how long it is kept. If anything here is unclear, write to info@dotnotfound.com.

Using it without an account

• What you type. The project description you enter is sent to an AI service (Anthropic) to generate name ideas. We don't store the descriptions, and our logs don't record them.
• Domains you check. The domain names are looked up through the public registries' RDAP service. Those registries receive the names, not who asked.
• Your IP address. We count how many searches each address makes in a day to keep the free tier fair; those counts reset daily. Our web server also keeps ordinary access logs (IP address, time, page) for security and fixing problems, typically for about two weeks.
• Analytics. We use a self-hosted, privacy-focused analytics tool that counts page views by page, referrer, browser and country. It sets no cookies and doesn't follow you across other sites.

If you create an account

• Account details: your email address and the name you give. We use the email to send sign-in links, invitations you ask for, and service messages.
• Sign-in: passkeys you add (we store only the public part and the name you give it), and your sessions (a hashed identifier, when it was created and last used, the IP address and browser it came from). You can see and remove passkeys, sign out everywhere, and revoke API keys on your account page.
• Orgs and teams: your membership and role, and any invitations (the invited email address is kept until the invitation is used or expires). Org owners and admins can see members' email addresses; other members see names.
• API keys: only a hash of each key, its name, which org it belongs to, and when it was last used.
• Blind rankings: the title, the candidate names, the display names of the people taking part, and each person's ratings, plus whether a rating was given on the website or through an AI chat. Guests are known only by the name the host gave them and a personal link (we store only a hash of it).
• An audit log of account and org changes (who did what, when) that records identifiers and event types, never names, emails, titles or ratings.

How ratings stay private

While a ranking round is open, the service never shows anyone's ratings, or any total built from them, to anyone but the person who gave them: not to the host, not to org admins. When the round closes, the host's choice at creation decides whether results show only totals, or also who rated what. This is a rule built into the service, not encryption: people who run the servers and databases can technically read the data, and we keep that access to what is needed to operate and secure the service.

Who else handles your data

• Anthropic processes project descriptions (and the names a ranking group liked or rejected, when a host asks for new name ideas; never who rated what) to generate names, under its own terms.
• Resend delivers our emails.
• Hetzner hosts the servers, in the United States (Oregon). Your data is therefore processed there.
• Domain registries receive the domain names you check.
• Payments. Paid plans are not available yet. When they are, payments will be handled by a payment provider (Stripe) and this page will be updated before then.

We don't sell personal information and don't show advertising. Registration links returned by our API and AI tools for available domains are affiliate links to a domain registrar: if you register through one, we may earn a commission at no cost to you. The website itself no longer shows them.

Cookies

We set only what the service needs: a sign-in cookie when you are signed in (up to 30 days, ending sooner if unused for a week), a short-lived cookie (minutes) while you add or use a passkey, and, for a guest who opens a personal ranking link, a cookie that keeps that link working in their browser. No advertising or cross-site tracking cookies.

How long we keep it

• Account, org and ranking data: until you or your org delete it, or you ask us to.
• Sign-in links expire after 15 minutes and invitations after 7 days.
• Server logs: typically about two weeks.
• Backups: nightly database backups are kept for about two weeks, so data you delete can remain in a backup for that long.

Your choices

You can change what you add, remove passkeys, revoke API keys, leave orgs and sign out everywhere from your account page. To get a copy of your data, correct it, or have your account and its data deleted, email info@dotnotfound.com; there is no self-service delete button yet. We'll answer within a reasonable time.

Children

dotnotfound isn't meant for children under 16 and we don't knowingly collect their information.

Changes

If we change this page in a way that matters, we'll say so on the site or by email before it takes effect. See also the terms of use.