Privacy.
We keep your domains. Not your secrets.

[Company name, organisation number, address], Sweden, is the controller of your data under the GDPR. Contact: [email protected].

• Your email (for sign-in links), workspace name and currency.
• The domains you add or import, with their projects, prices, payments and notes.
• Registry records (RDAP and WHOIS) for those domains, kept up to 2 years as evidence.
• Check results: raw for 30 days, then daily summaries.
• Alerts we've sent you.
• Per notification device: its push address, keys and a label like “iPhone · Safari”.
• Webhooks and email channels you add.
• If you connect Cloudflare: its API token or sign-in tokens, encrypted with AES-256-GCM and used for read-only calls only.

Everything else stays until you delete it, or your workspace. Then it's gone, apart from backups that age out within 30 days.

To run the service you signed up for (GDPR art. 6(1)(b)). Server logs and abuse protection rest on our legitimate interest in keeping nmspc up and honest (art. 6(1)(f)).

Our own server at Hetzner Online GmbH in Finland, in the EU. The database is on the same machine.

• Resend sends email: sign-in links, and alerts on Pro.
• Cloudflare, only if you connect it. We read your Registrar domains and, if you allow it, your DNS zones.
• Apple, Google, Mozilla, Microsoft run the push services that deliver notifications. Some of them sit in the US; a notification carries only its title and a line of text.
• Domain registries: we ask their public RDAP and WHOIS servers about domain names.
• The sites you monitor get our HTTP, TLS and DNS requests.

A session cookie keeps you signed in. Short-lived security cookies guard the “It's mine” and Connect Cloudflare steps. Your theme choice sits in your browser's local storage. No analytics, no ads, no tracking cookies.

Results are cached for an hour. We don't record who checked what, beyond normal server logs.

• Access and export: Settings › Account › Export downloads everything as JSON.
• Correction: edit it in the app, or write to us.
• Deletion: Settings › Account › Delete workspace removes domains, checks and alerts. Disconnecting Cloudflare deletes the stored token and revokes sign-in access.
• Objection: write to [email protected].
• Complaints go to IMY, Integritetsskyddsmyndigheten, Sweden's data protection authority.