Privacy Policy

This policy covers SubDomains Finder (subdomainsfinder.com), the scanner itself, the optional free account, and the optional newsletter. It does not cover other sites we link to, including the domains that appear in your scan results.

Using the scanner never requires an account. Everything below about accounts and the newsletter applies only if you choose to sign in.

For what we log about a domain lookup itself (your IP address against the domain you searched, and how long we keep it), see Acceptable Use and Scan Authorization. This page covers everything else: accounts, authentication, and the newsletter.

If you create an account (via Clerk, our authentication provider): your email address and whether it is verified, which sign-in method you used (email code, Google, or GitHub), and an internal account ID we generate ourselves. That internal ID, not Clerk's own ID, is what every other record about you points to, so your history survives if we ever change authentication providers.

If you subscribe to the newsletter: the exact time you agreed, which version of the consent wording you saw, a fingerprint (hash) of that wording so we can prove it was not altered later, the page you agreed on, your IP address and browser at that moment, and, if you unsubscribe, when and how. If we ever deliver the newsletter through a provider such as Substack, we also store whatever subscriber ID that provider assigns and when we last synced with it.

Every scan: your IP address and the domain you searched, kept as one row per IP-and-domain pair with counters rather than a full request log. Details and retention are on the Acceptable Use page.

Site analytics: we use Google Analytics to understand traffic and which pages are useful. It sets its own cookies and collects standard analytics data (pages viewed, rough location, device type). We also use Microsoft Clarity, which records how pages are used (clicks, scrolling, mouse movement) to produce heatmaps and session replays, and sets its own cookies. Text typed into forms is masked. We do not feed your account or newsletter data into either.

The feedback board (/feedback) uses Google reCAPTCHA to stop spam submissions. Google receives the data reCAPTCHA needs to do that; see their own privacy policy for details.

Your browser, locally: a couple of small flags (for example, whether you have already been shown the sign-up or newsletter prompt) are stored in your browser's local storage so we don't ask twice. These never leave your device and we never read them.

• -running your account and remembering who you are between visits
• -sending the newsletter, and keeping your subscription preference accurate
• -proving what you agreed to and when, if that is ever in question
• -making sure an unsubscribe stays an unsubscribe: it stops an address being silently re-added by a later import or sync
• -rate limiting and abuse prevention, so the free tool stays usable for everyone
• -security, and meeting legal obligations where we have them

We do not sell your data, and we do not use your account or newsletter data for advertising or for profiling you.

We use a small set of infrastructure providers to run the service. Each only sees the data it needs to do its job:

• -Clerk handles sign-in and verifies your email. Clerk never sees your newsletter or scan data.
• -Substack (or another newsletter provider we may switch to later) delivers the newsletter to subscribed addresses. It does not receive your scan history or account credentials.
• -Turso, Upstash, and Vercel host our database, cache, and application respectively. They store data on our behalf and do not use it for their own purposes.
• -Google (Analytics and reCAPTCHA) as described above.

Domain lookup data sources (certificate transparency logs, passive DNS, network registries, and our own port-scan service) never receive anything about you personally. They only ever see the domain name you searched.

We disclose data to law enforcement where we are legally required or lawfully requested to, and as described on the Acceptable Use page. Otherwise we do not sell or rent your data to anyone.

For a new account, subscribing to the newsletter is always an active choice: the checkbox is never pre-checked. Our free account's higher daily scan limit is bundled with the newsletter as part of that free plan (see Pricing). You can always use the scanner without an account, and an account without the newsletter still works, just at the guest limit.

If your account existed before this requirement did, we kept your existing higher limit rather than taking it away: your subscription was set up on your behalf, on the same terms the site already displayed to you when you signed up, rather than asking you to opt in again for something you had already effectively agreed to. You can unsubscribe from it the same way as anyone else, described below.

You can unsubscribe at any time using the unsubscribe link in any issue of the newsletter. That stops the emails, and our newsletter provider keeps the address unsubscribed. It does not delete your account, and on its own it does not change your daily scan limit. If you subscribe again later, that is a new and separate decision, and we record it as one.

We keep your original consent record (what you agreed to, and when) even after you unsubscribe, for the reasons set out under retention below.

Account data is kept while your account is active, and for a reasonable period after you ask us to delete it, in case that request itself needs to be verified.

Consent records (what you agreed to, and when) are kept even after you unsubscribe or delete your account. That is not an oversight: it is the evidence that lets us prove what happened if a dispute or a legal request ever requires it, and it is what stops a suppressed address from being silently re-added. We do not use a kept consent record for anything except answering that question.

Scan history (IP address against domain searched) is covered on the Acceptable Use page, which has the current retention window.

Depending on where you live, you may have the right to:

• -ask what personal data we hold about you
• -ask us to correct inaccurate data
• -ask us to delete your account and associated data, subject to the retention explained above
• -ask for a copy of your data in a portable format
• -withdraw newsletter consent, which you can also do directly from your account

To exercise any of these, reach out through the contact page. We aim to handle requests within a reasonable time and in line with applicable law, including GDPR and similar regulations where they apply to you.

This service is intended for professional and technical use and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.

If we change what we collect or how we use it, we will update the effective date at the top of this page. For newsletter consent specifically, a material change gets its own new consent version rather than silently changing what an existing subscriber already agreed to, per the newsletter section above.

Questions about this policy, or a request about your own data, can go through the contact page.