Privacy Policy

Zone File Uploads

When you use the Zone Analyzer, all file parsing is performed locally within your browser using JavaScript. Your DNS zone export files are never transmitted to our servers or any third party. The parsed records are kept in the page's memory while you work.

Some details are also saved in your browser's storage, which can outlast the tab. The analyzer saves the uploaded file's name in session storage and local storage until you choose New file. When you open a verification utility (screenshots or HTTP status checks), the records you selected, including host names and record values, are saved in session storage and local storage so the new tab can read them. Those entries are not removed automatically. To remove them, clear this site's data in your browser. On a shared computer, use a private window.

DNS Queries

When you use our DNS lookup and reconnaissance features, your submitted domain input is sent to our servers so queries and related checks can run on your behalf. These lookups may rely on third-party DNS infrastructure.

To improve performance and reliability, results may be cached for a limited period using technical request context rather than personal profiles.

Verification Utilities

Some verification utilities may send selected host targets to server-side services for additional processing (for example page rendering or protocol validation).

Utility responses may be cached for performance and may be subject to operational limits and safety controls.

Market Index Data

The Market Index page combines delayed market reference data with DNS posture scoring for listed companies. Market data is sourced through third-party providers and may be stale, delayed, incomplete, or unavailable at any time.

We cache market snapshots and DNS-derived scoring outputs for performance and reliability. These records are tied to company symbols and domains, not to personal user profiles.

Logs and Rate Limiting

Our servers maintain short-lived request logs for operational purposes (error monitoring, rate limiting, and abuse prevention). These logs may include IP addresses and requested domain names. Logs are not retained beyond what is needed for these operational purposes and are not used to build profiles of individual users.

Rate limiting counters are tracked per IP address to ensure fair use of the service. These counters are ephemeral and do not persist beyond a rolling 24-hour window.

Accounts and Sign-In

Accounts are optional. You can use the free tools without one. To sign in, you enter your email address and we email you a one-time sign-in link that expires after 15 minutes. We store your email address, when the account was created and last signed in, and a record of each sign-in session. A session lasts up to 30 days, or until you sign out.

If you buy the paid plan, payment is handled by Stripe on its own checkout pages, and we never see or store your card details. We store the Stripe customer and subscription identifiers and the subscription's status, billing interval and renewal date, so we know which plan your account has.

Deleting Your Account

To ask for your account to be deleted, use the contact form, choose Account Deletion Request as the subject, and send it from the email address you sign in with so we can match the request to your account. We reply by email once the request has been handled.

Domain Tracking and Alerts

If you track a domain in Website Recon, the domain is linked to your account along with when you started tracking it and whether email alerts are on. Our scheduler checks the domain's public registration (RDAP) record about once a day and stores what it observes and what changed. When alerts are on, we queue and send change and expiry alerts to your account's email address and keep a record of each alert.

Stopping tracking removes the link between the domain and your account and ends checks once nobody tracks it. It does not delete the registration history already collected for the domain, which is public registry data kept so that tracking it again continues the same timeline.

Contact Form Data

If you submit the contact form, we process the information you provide along with operational metadata needed to route requests, prevent abuse, and respond to support inquiries.

Cookies and Local Storage

DNS Panopticon sets two first-party cookies, and only when you sign in:

• dnsp_session holds your sign-in session token. It is HttpOnly, so page scripts cannot read it, and it lasts up to 30 days.
• dnsp_signed_in holds no secret. It only tells page scripts that a session exists, so pages check your account only when you are signed in. It has the same lifetime.

Both are sent only to this site, use SameSite=Lax and the Secure flag, and are removed when you sign out. They are needed for sign-in and are not used for analytics or advertising.

We also use your browser's local storage and session storage for interface preferences (such as the colour theme, chart choices and Zone Analyzer filters), the page to return to after signing in, an administrator sign-in token for site administrators, and the Zone Analyzer data described under Zone File Uploads. This data stays in your browser, is not used for cross-site tracking, and is removed when you clear this site's data.

Third-Party Services

• Google Fonts — Typography is loaded from Google Fonts. Google may log font requests in accordance with their own privacy policy.
• Cloudflare — The site uses Cloudflare infrastructure for hosting, networking, security, and certain verification-related processing. The contact form uses Cloudflare Turnstile to check that a person is sending it.
• Stripe — Payments for the paid plan are processed by Stripe under its own privacy policy.
• Resend — Sign-in links, domain tracking alerts and contact form messages are sent through Resend, which processes the recipient address and message content to deliver them, under its own privacy policy.

No advertising networks, analytics platforms, or tracking pixels are used on this site.

Children's Privacy

DNS Panopticon is not directed at children under the age of 13 and does not knowingly collect information from children.

Changes to This Policy

If this policy is updated, the revised version will be posted on this page with an updated date. Continued use of the service after changes constitutes acceptance of the revised policy.

Contact

Questions about this privacy policy can be directed to our contact page.