Domain Finder Privacy policy
This explains what personal data Domain Finder collects, why, who sees it and how long we keep it. We have tried to say it plainly and to describe only what the site really does.
1. Who we are
Domain Finder is run by Oyoxa. We are the “controller” of the personal data described here. To ask anything about your data, write to privacy@oyoxa.com.
2. What we collect, and why
| What | Why | Our legal basis |
|---|---|---|
| Your account — username, email address and a password (stored only as a one-way hash). | To create your account, sign you in and keep it secure. | Contract (providing the service you asked for) |
| What you do while signed in — the names you like or pass on, thumbs up/down, your saved default filters, your re-check requests and your daily usage counts. | To make the product work, to tune which names you see, to rank names (votes are combined across users), and to enforce fair-use limits. | Contract; legitimate interests (running and protecting the service) |
| Your hunts — if you use Hunt mode: the project name you type, the extensions and lengths you chose, which names you liked or passed on, your head-to-head choices, your champion and shortlist, when you crowned a name, and a few usage events (for example that a stop prompt was shown, or that you clicked a register link). | To run the hunt, to show your odds and results, and to measure whether Hunt mode helps people reach a decision (counts across all users, not profiles of individuals). | Contract; legitimate interests (improving the service) |
| Preview pages and waitlists — if you make a preview page: the sentence you describe it with, the words on the page, and the email addresses visitors give to its waitlist. If you join someone’s waitlist: your email address and when you joined. | To show the page, and to give the page’s owner the list of people who asked to hear when it launches. The owner decides what to do with the addresses; we store them for them and do not use them for our own marketing. | Contract (with the page’s owner); legitimate interests (running and protecting the service) |
| Register-link clicks — when you click a “Register” or “Check” link we note the name, which page the link was on, and your account number if you are signed in. Not your network address. | To see which pages help people reach a decision, and to check that any referral commission is reported correctly. | Legitimate interests (improving the service) |
| The free preview, without an account — a random cookie, a one-way hash of your network address (not the address itself) and counts of cards shown and swipes made. | To enforce the free-preview limit and stop automated copying of the name list. Preview swipes are not stored as votes and are not linked to any account. | Legitimate interests (protecting the service) |
| Text you enter in tools — topics in Seed Words (sent to the Datamuse word service as search terms) and the categories you pick in Niche search. | To fetch related words and to build your niche shortlist. Niche results are cached briefly so a repeat search is quick. | Contract |
| Standard server logs — the web host records requests (address, page, time) for security and fault-finding. | Keeping the site secure and working. We do not use logs to build profiles of people. | Legitimate interests |
Some things stay only in your own browser and are never sent to us: your shortlists and projects, the names you liked in the free preview (kept so they can be added to your account if you sign up), your filter choices on some pages, and a random browser id that lets us move votes you made before you had an account onto your account.
We do not ask for, or knowingly collect, special-category data, and you do not need to give us your real name.
3. Cookies
| Cookie | What it is for | Lasts |
|---|---|---|
| Session cookie | Keeps you signed in. Essential. | Your session |
df_anon | A random token that lets us count the free preview. HttpOnly. Essential for the preview. | 30 days |
This site does not use advertising cookies or third-party analytics. If that ever changes we will say so here and ask first where the law requires it.
4. Who else is involved
- Datamuse (api.datamuse.com) — receives the topic words you type into Seed Words. No account or personal details are sent.
- Domain registries (via the public RDAP and WHOIS services) — receive the domain names we check, from our server. Nothing about you is sent.
- An AI provider (currently Anthropic) — for the paid AI niche ranking only: receives the categories and feel you chose and a list of candidate domain names. No account details or personal data are sent.
- Our hosting provider — stores the database and server logs on our behalf.
- Domain registrars — links to a registrar take you off this site; their own privacy policy applies from there. Some of these links may be affiliate links (see our Terms), so the registrar or its affiliate network may know you arrived from us.
- If we add paid plans, a payment provider will handle card details; we will not see or store your full card number.
We do not sell personal data, and we do not share it for advertising.
5. How long we keep it
| Data | Kept for |
|---|---|
| Free-preview records (cookie token, hashed address, counts) | 30 days after last use, then deleted automatically |
| Your re-check history | 90 days, then deleted automatically |
| Preview pages | Live for 60 days; the waitlist is kept 30 days after that so the owner can export it, then deleted. Owners can clear a waitlist or remove a page at any time. |
| Register-link clicks | 180 days, then deleted automatically |
| Cached niche-search results | 7 days |
| Daily usage counters | A few days (they only matter for today’s limit) |
| Your account, votes, saved filters and hunts | Until you ask us to delete your account. Server logs are kept by the host for its normal period. |
6. Your rights
Under UK data-protection law you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. To use any of these, email privacy@oyoxa.com; we will answer within one month. To delete your account and the votes and hunts tied to it, tell us the username on the account. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ico.org.uk), though we would like the chance to put it right first.
7. Security
Passwords are stored as one-way hashes, access to administration pages is restricted, and the public site limits automated access. No system is perfectly secure; if a breach affects your data and the law requires it, we will tell you and the regulator.
8. Children
Domain Finder is not intended for anyone under 16 and we do not knowingly collect data from them.
9. Changes
If we change what we collect or why, we will update this page and the date at the top; for significant changes we will also tell signed-in users.
Questions: privacy@oyoxa.com.