Privacy

Your searches are yours

Nothing you search is published, sold, or shown to another user unless you press Share. We don’t register domains, so we have nothing to gain from the names you find.

The same goes for your tool history: when you’re signed in, what you type into Lookup and the other instant tools is kept in My Searches › Tool runs so you can run it again. Only you can see it, and you can turn it off or clear it in Settings.

Searching for names for a company you haven’t launched yet is exactly when this matters.

Two things are public, on purpose

We’d rather say so here than let you find out later.

A search you press Share on gets a public link. That’s the point of the button. It publishes the recipe too — the search name and which word lists lists it used — not just the results.
Globally shared word lists are public by design. Your own lists are not. Neither is any search you don’t share.

Domain checks and third parties

Checking whether a name is available means asking someone who knows — the registry that runs the TLD, or a public DNS resolver. That query contains the domain being checked. There is no way to check availability without asking, and any tool that claims otherwise is guessing.

What we don’t send is who asked. Your account isn’t attached to the lookup, and we don’t pass your searches to registrars, brokers, or advertisers.

Opting out of Google Analytics

We use Google Analytics to see which pages get used. The site works exactly the same without it, so block it if you’d rather not be counted. You have three levels:

Decline in the cookie banner (or Cookie settings at the bottom of any page). No analytics cookies are set. Google still receives anonymous, cookieless pings with no identifier.
Use a tracker blocker, which stops Google Analytics from loading at all, here and on every other site:
- Firefox: uBlock Origin, or Firefox’s own Enhanced Tracking Protection set to Strict (no add-on needed).
- Chrome and Edge: uBlock Origin Lite (the original uBlock Origin no longer runs on Chrome), or AdGuard with its tracking protection filter on.
- Any browser: Ghostery, or the Brave browser, which blocks it out of the box.
Google’s own opt-out add-on tells Google Analytics not to send anything, on every site. It installs normally on Chrome. On Firefox the page offers a direct .xpi download instead of a listing in Firefox’s add-on store, and in our testing it wouldn’t install, so use one of the options above.

The details are in section 5 of the Privacy Policy below.

Coming: run it yourself

We intend to sell a self-hosted copy of the entire application — roughly three to six months from August 2026 — so you can run it on your own server, with your own database.

That is the strongest privacy answer we can give you. Every assurance above is a promise about what we do with your searches. Self-hosting removes us from the question: the searches never reach us at all, because there is no “us” in the path.

What is for sale is the software. It ships with the import scripts that fetch each dataset from its own source, so you build your copy from current data under that source’s own terms — rather than inheriting a frozen snapshot of ours. It does not come with anyone’s account, searches, or messages.

Price is not set yet, and neither is the exact date — we would rather say that than invent a number on a page about trust. Setup help and after-sale support will be available at $100/hour. Register your interest and we will tell you when it is real.

Terms of Service — the agreement you accept when you sign up. Its section 8 points here, to the Privacy Policy below.

Contact — if something here isn’t clear, or you want data removed, ask.

Privacy Policy

Version 2026-11-privacy-v4, effective 3 November 2026.
SHA-256: 0f9b94601a0e207ca46869fe2ad2f8ca2f5a9718b04254134cf0043615394773

Summary

We collect what we need to run DNS Lister: your account, the searches and lists you create, and technical logs that help us keep the site working and stop abuse.
We do not sell your personal information. We don't show ads, and we don't share your searches with registrars, domain brokers or advertisers.
We use Google Analytics to understand how the site is used. It sets cookies only if you accept them in the cookie banner, and the site works the same either way.
You can delete your account at any time from Settings, and you can ask us for a copy of your data.

The rest of this page is the detail.

1. Who we are

DNS Lister (dnslister.com) is an independent service operated from Washington State, USA. "We", "us" and "our" mean its operator. To reach us about privacy, use the contact form.

This policy covers dnslister.com and its tools. It works together with our Terms of Service. If the two ever seem to disagree about your personal information, this policy is the one that applies.

2. What we collect

2a. Information you give us

What	When	Why
Username and email address	Sign-up	To create your account, sign you in, and send account email (verification, password resets, notices you opt into)
Password	Sign-up, password change	To sign you in. We store only a one-way bcrypt hash, never the password itself. We can't see or recover it.
Email marketing choice	Sign-up, Settings	To honor whether you want product news. Off unless you turn it on.
Searches, results, Favorites, word lists, notes, score rules, pins and settings	While you use the site	That's the service: to save and show you your own work
Messages you send us	Contact form, or the Ask a Question box on a word list	To reply. We keep your name, email, message, the IP address it came from, and the page you opened the form from (if you came from another website, only that site's name).
Premium requests and coupon codes	When you ask for Premium or redeem a code	To grant and track your Premium access

2b. Information collected automatically

What	Details	Why
Sign-up record	IP address, browser user agent, referring page, and the HTTP request headers your browser sent when you signed up	Abuse and spam prevention, and support
Terms acceptance record	The exact Terms version you accepted (with a fingerprint of its text), the time, your IP address and user agent	Proof of what you agreed to
Access log	For every page request: the page address, time, IP address, browser user agent, referring page, and your account ID if signed in	Security, troubleshooting, abuse prevention, and understanding which pages are used
Sign-in and session records	Sign-in attempts (with IP), and your active sessions (with user agent)	Keeping you signed in, letting you sign out other devices, and blocking password-guessing
Usage counters	Counts of views, runs, shares and downloads of searches, lists and tools, with IP and account ID for a limited time	Showing popularity (for example "Most used" on /tools) and spotting abuse
Download log	When you export or download data: what, when, IP, user agent and account ID	Abuse prevention and support
Error reports	If a page crashes: the error, the page, and your account ID and IP	Fixing bugs
Spam and abuse attempts	Blocked sign-ups, contact-form spam, blocked words: the content, IP and user agent	Blocking spam and abuse

2c. What we don't collect

No payment card numbers. Premium payments go through PayPal, Venmo or Cash App; we only see that a payment happened.
No precise location. We never ask your device for its location.
No contacts, files or anything outside what you type into DNS Lister.
We don't knowingly collect anything from children (see section 10).

3. How we use it

We use personal information only to:

Provide the service: run your searches, check domain availability, and save your work.
Run your account: sign-in, security, password resets, and service notices.
Keep the site safe: detect abuse, spam, scraping and password-guessing.
Fix and improve the site: error reports, performance, and which features people actually use.
Send product news, but only if you opted in. You can turn it off in Settings at any time.
Meet legal obligations, if we're ever required to.

We don't:

sell or rent personal information;
use your searches to register, reserve or buy domains;
show your private searches or lists to anyone else;
use your data to train AI models or hand it to anyone who does;
build advertising profiles.

4. Your searches

The plain-language promise at the top of this page is part of this policy: nothing you search is published, sold, or shown to another user unless you press Share.

Two things are public on purpose:

A search you Share gets a public link, including its name and which Favorite Keywords lists it used.
Globally shared Favorite Keywords lists are public by design.

Checking whether a domain is available means asking the registry for that extension (RDAP/WHOIS) or a public DNS resolver. That request contains the domain name being checked, sent from our server. It doesn't contain your name, email, account or IP address.

5. Cookies and similar technologies

Name	Type	Purpose	Lasts
`domain_name_finder_sess`	Essential cookie	Keeps you signed in	Until you sign out or it expires
`_ga`, `_ga_<id>`	Google Analytics cookies, only if you accept them	Counts visits and anonymous usage patterns	Up to 2 years (Google's default), or until you decline
Browser local storage (for example your cookie-banner choice, your domain-check speed settings and the /tools sort choice)	Stored only in your browser	Remembers your display and tool preferences	Until you clear site data

Local storage never leaves your browser; we can't read it.

Google Analytics loads after you interact with a page (or a few seconds after it opens). On your first visit, a banner asks whether to allow analytics cookies.

Until you accept, Google Analytics sets no cookies. It sends only cookieless pings with no identifier, which Google uses to estimate visit counts.
If you accept, it also sets the _ga cookies above. These tell us things like which pages are visited, roughly which country visitors are in, and what devices they use.
Advertising features are always off, whatever you choose.

You can change your choice at any time with the Cookie settings link at the bottom of every page. Declining removes any _ga cookies already set. Google processes this data under its own privacy policy. You can also block Google Analytics completely with any ad or tracking blocker, or with Google's opt-out add-on. The site works normally without it.

We don't use advertising cookies, retargeting pixels or social-media tracking pixels.

6. Do Not Track and Global Privacy Control

Most browsers can send a "Do Not Track" signal. There's no agreed standard for what it should mean, so we don't change our behavior in response to Do Not Track or Global Privacy Control signals. To stop analytics cookies, choose Decline in the cookie banner (or use Cookie settings at the bottom of any page), or block Google Analytics as described in section 5.

7. Who we share information with

We share personal information only with service providers that help run DNS Lister, and only what each one needs:

Provider	What they receive	Why
SMTP2GO	Your email address and the content of emails we send you	Delivering account and opted-in email
Google Analytics	Page views, device/browser, approximate location from IP	Usage statistics
PayPal, Venmo or Cash App	Whatever you give that service when you pay	Processing Premium payments (under that service's own privacy policy)
Our hosting provider	Everything on our server, stored on their hardware	Hosting the site and database
Domain registries and DNS resolvers	Only the domain names being checked, never who asked	Availability checks

We may also disclose information:

if required by law, subpoena or court order;
to protect the rights, safety or property of our users, the public or us (for example, to stop fraud or abuse);
to a successor, if DNS Lister is ever sold or merged. This policy (or one at least as protective) would continue to apply, and we'd notify you first.

8. How long we keep it

Data	Kept for
Account, searches, lists, Favorites, settings	Until you delete them or delete your account
Access log (page requests)	90 days
Error reports	90 days or less
Sign-in attempts, spam and abuse attempts	90 days
Usage counters and download log	IP address, user agent and account link removed after 90 days; anonymous counts kept
Emails-sent log and admin activity log	12 months
Contact-form messages	Up to 12 months after we've read them
Sessions	Until sign-out or expiry
Terms acceptance records and Premium/payment records	As long as needed for legal and bookkeeping purposes. If you delete your account they are kept with no link to you.
Server backups	Deleted data can remain in a backup until that backup is replaced on its normal rotation

9. Your choices and rights

Wherever you live, you can:

See and correct your information: most of it is visible and editable in Settings. To change your username or email address, contact us.
Delete your account yourself, at the bottom of Settings. This permanently deletes your account, searches, Favorites and private word lists, and your shared links stop working. Word lists you shared globally stay available to others but are no longer linked to you. Log records lose their link to your account, and records kept for legal reasons (section 8) are detached from your identity.
Get a copy of your data: contact us and we'll send it in a common format within 30 days.
Stop marketing email: turn it off in Settings.
Turn analytics cookies on or off: use Cookie settings at the bottom of any page, or block analytics completely (section 5).

We don't charge for any of these, and we won't treat you differently for using them.

California residents: under California's Online Privacy Protection Act (CalOPPA), this policy lists what we collect, whom we share it with, how you can review and change it, and how we respond to Do Not Track. We don't sell or share personal information for cross-context behavioral advertising.

Visitors from the EU/UK: DNS Lister is run from the United States, and your information is processed there. We rely on providing the service you asked for (contract) and on our legitimate interest in security and improving the site. You can ask for access, correction, deletion, restriction, portability, or object to processing by contacting us. You may also complain to your local data protection authority.

10. Children

DNS Lister isn't meant for children under 13, and we don't knowingly collect their information. If you think a child has signed up, contact us and we'll delete the account.

11. Security

Passwords are stored as bcrypt hashes.
The site is served only over HTTPS.
Every form is protected against cross-site request forgery.
Database access uses parameterized queries.
Admin access is limited.

No system is perfectly secure. If a breach ever affects your personal information, we'll notify you as required by law, including under Washington's breach-notification law (RCW 19.255.010).

12. Changes to this policy

When we change this policy, we publish a new version with a new effective date and keep previous versions on file. For significant changes, we'll show a notice on the site or email account holders before they take effect.

13. Contact

Questions or requests: use the contact form.