Privacy

Last updated 6 October 2026.

Your searches

We don’t keep the names you search or the descriptions you type. We never register, reserve, sell or share them, and we don’t use them to buy domains. Nobody at TLDMath watches searches to grab names.

• A normal search sends the name to the registrars we compare (Porkbun, Namecheap, Dynadot, Cloudflare, Vercel, NameSilo, Name.com and Hostinger) through their official APIs, the same as searching on their own sites, so they can see it. We don’t store the name: prices are held in our server’s memory for up to 10 minutes so a refresh doesn’t ask every registrar again, then forgotten.
• A private check asks only the registry that runs the extension (for example Verisign for .com), through its public RDAP service. No registrar search API is used and we store nothing about it: it isn’t logged, cached or kept in our statistics, and the name is sent in the request body, not the URL. It shows whether a name is registered, but not prices. Some extensions, including .io, .co and .me, have no public registry lookup.

What we store

• Usage statistics: what kind of request it was (a search, the launch kit, a renewal check, one of the free tools and so on), whether it came from the website, the API or the MCP connector, the time, and at most the extension (like .shop). Never the name you searched or the description you typed.
• Which registrar or sign-up link you clicked and the extension, never the domain. Used to understand which results help people.
• A one-way hash of your IP address, kept for up to an hour, to rate-limit abuse. Raw IP addresses are not stored.
• Public registry details (registrar, registration and expiry dates, status) only for domains someone has put on their own Renewal watch list, refreshed every 7 days. Lookups for any other domain, such as a renewal check without an account, the ownership card or a taken-domain check, are held briefly in our server’s memory and never stored.
• If you use Renewal watch with email reminders: your email address, the domains on your watchlist, any renewal prices or dates you enter, and a log of the emails we sent you. You can stop the emails from any of them, and delete your account and watchlist from the Renewal watch page at any time. The live calendar link contains a private key: anyone who has it can see your renewal dates, so share it only with your own calendar app.
• When you press Share this receipt: that one result (the domain and its prices at that moment), saved under a random link so the person you send it to can open it. Nothing is saved unless you press Share, shared links don’t reveal anything else you searched, and they are kept out of search engines. Email us to delete one.
• When you use “Describe my project”, we send your description to Anthropic’s Claude API to suggest names and keep nothing: not the description, not the ideas.
• If you reply to one of our “drop your startup link” posts with your link: your domain, the X handle you replied from, and a launch check of the domain (from public records, including loading your site’s home page on both addresses). They appear on the domain table and on a card under a random link. Reply “remove” or email us and you’re taken off the same day.
• When you plan moving an app, the page sends only package names and environment-variable names; it removes every value in your browser before sending. We use the names to build that plan and don’t store them.

What we share

To price a domain we send that domain name to registrar APIs (Porkbun, Namecheap, Dynadot, Cloudflare, Vercel, NameSilo, Name.com and Hostinger). To suggest names we send your project description to Anthropic’s Claude API. To look up a domain’s registrar and expiry date we query the public registry for that TLD (RDAP). To check handles we request the public profile URL for that name on GitHub, npm, PyPI, crates.io and YouTube. The launch kit, move plans and ownership cards look up the domain’s public DNS records through Cloudflare’s public resolver (1.1.1.1), and their live check loads the domain’s home page over HTTPS, as a visitor would. The AI visibility check reads the site’s public robots.txt, llms.txt and sitemap and loads its home page the same way; it stores none of it. Sign-in links and renewal reminders are sent through our email provider, Resend, which receives your email address for that purpose. We don’t send anything else about you.

TLDMath runs on Vercel (hosting, US) and Supabase (database, US), which process requests and the data above for us. Requests to Namecheap’s API go through a small relay server we run at Hetzner in Germany, which forwards the domain name to Namecheap. Like any web host, Vercel’s request logs record IP addresses and the web address requested for a limited time; for a normal search that address includes the name. When you click a buy or sign-up link you go to that company’s site, and its privacy policy applies there.

On your device

Your recent searches, your shortlist (the names you star), your “Describe my project” choices, your launch path (the domain you’re launching and which steps are done) and the setup steps you tick in the launch kit and move plan are kept in your browser’s local storage. They never leave your device as a list: opening the shortlist checks each name live, like a normal search, and we don’t keep the names.

If you arrive from a link that names a campaign (for example an ad), a cookie remembers that campaign name for 30 days so we can tell which campaigns are useful. It holds only the campaign name, nothing about you. If you sign in to Renewal watch, a cookie keeps you signed in.

Page views

We count page views with Vercel Web Analytics, which sets no cookies and doesn’t identify you. It receives the page you opened with everything after the “?” removed except a campaign tag (so never a searched name or a sign-in token), the site you came from, and your browser, device type and country.

MCP connector and Agent Skill

The connector is read-only. It receives only the tool arguments your AI client sends (a domain, name or TLD, a project description, a list of domains, a host and email choice, and for a move plan package and environment-variable names, never values) and handles them as described above.

The tldmath-launch Agent Skill is a set of instructions that runs inside your own AI tool. It asks TLDMath for the same read-only plans. Any change it makes to your DNS, hosting or email runs on your computer with your own logins and keys, which are never sent to TLDMath.

Contact

TLDMath is operated by Riverbend Crossroads Digital LLC. For questions or deletion requests, email support@tldmath.com.