Privacy Policy

Last updated: 7 September 2026

This policy describes how domscout (“we”) handles personal data for the domscout API and dashboard at www.domscout.io. domscout is operated by an individual owner; there is no registered company. It describes the service as it is actually built — where a limit or a retention period is stated below, it is the one the software enforces.

1. What we collect

Account data

Authentication is handled by Clerk. We receive your email address, and your name and avatar if your identity provider supplies them. We never receive or store your password.

API credentials

API keys are stored as SHA-256 hashes alongside a short non-secret prefix used to identify the key in listings. The full key is shown once at creation and cannot be recovered afterwards, by you or by us.

Usage records

For each API request we record the request id, the account and key that made it, the target URL, the capture mode and format, latency, response size, credits consumed, and the outcome. These drive quota enforcement, billing, rate limiting and abuse investigation.

Captured content

When you ask us to capture a page, we fetch that page and store the artifacts you requested — image, PDF, Markdown, extracted fields, DOM snapshots. This content comes from the URLs you choose. We do not select it, and we do not inspect it except as needed to run the request you made.

Payment data

We do not receive or store card numbers. Payments are processed by Dodo Payments as merchant of record. We store the resulting subscription state, plan, billing period and metered usage counts.

2. How long we keep it

Saved captures expire automatically. The maximum retention is set by plan, and a request may choose any shorter period on its plan’s ladder:

Expired captures are removed from storage and can no longer be retrieved. Usage and billing records are kept for as long as we are required to retain financial records. Account data is kept while your account exists.

3. Where it is processed

Processing happens in two regions, and both are named because they are in different countries:

• Capture execution and artifact storage — AWS us-east-1, United States. This is where page rendering runs and where saved screenshots, PDFs and Markdown are stored.
• Account and usage database — Supabase in AWSap-northeast-1, Tokyo, Japan. This is where your account record, API key hashes, subscription state and usage logs live.

Depending on where you are, this means your data is transferred to and processed in the United States and in Japan.

4. Sub-processors

Content is sent to the model provider only when you call a route that needs one — AI extraction, or semantic indexing. Ordinary captures, crawls, monitors and Markdown extraction never reach a model provider.

5. What we do not do

• We do not sell personal data.
• We do not use your captured content to train models.
• We do not run advertising.
• We do not run third-party analytics or tracking on the dashboard, or on any signed-in page.

6. Cookies

The dashboard sets a session cookie through Clerk so you stay signed in, and stores a theme preference in your browser. Neither is used for advertising or cross-site tracking. The public API is authenticated by header and sets no cookies.

Our public pages — the homepage, docs, pricing, blog and product pages — use Google Analytics to count visits and show us which pages people arrive on. It sets the _ga and _ga_<id> cookies, and it sets them only after you accept: analytics storage starts denied, declining leaves it denied, and no analytics cookie is written in either case until you choose otherwise. We do not enable Google Signals, advertising features or remarketing, so ad storage and ad personalisation stay denied permanently.

Google Analytics does not load on the dashboard or any other signed-in page. You can change your decision at any time — this returns you to the undecided state, revokes analytics storage immediately, and shows the banner again:

7. Your rights

You can access and export your account data from the dashboard, delete individual saved captures at any time, and delete your account — which removes your account record, API keys and saved captures, subject to financial records we must retain. Depending on where you live you may also have rights to correction, restriction, objection, and to complain to a supervisory authority. Write to support@domscout.io and we will respond within 30 days.

8. Security

Data is encrypted in transit and at rest. API keys are stored only as hashes. Page rendering runs in an isolated, network-restricted environment that holds no database credentials, so a hostile page cannot reach customer data. Access to production is limited to the operator.

9. Children

The service is for developers and businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

10. Changes

If we change this policy materially we will update the date above and notify account holders by email before the change takes effect.

11. Contact

domscout is operated by an individual owner and is not a registered company, so no registered address is published. Data-protection questions and rights requests go to support@domscout.io, which reaches the owner directly. Governing law: India.

Questions about this document: support@domscout.io. See also our Terms of Service and Privacy Policy.