Privacy policy

What dotbunker stores, for how long, and who else sees what.

This policy explains which personal data dotbunker processes when you use dotbunker.com, why, and for how long. We have written it from what the service actually does, and we keep it short where the answer is "nothing is stored".

Controller

Ümit Cekirge
Schleiermacherstraße 34
06114 Halle (Saale)
Germany

Email: [email protected]

Visiting the site

Cloudflare. The website is delivered through Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which also runs the pages that are rendered on the server. Cloudflare necessarily processes your IP address, the page you request, your browser's user agent and the time of the request, and uses them to deliver the site and to protect it from attacks. Cloudflare may set a technically necessary security cookie (__cf_bm) to tell people from bots. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Our API server. Lookups, accounts and the price catalogue are served by our own server at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). It processes your IP address for each request. We use it to limit how many requests one address can make per minute; that counter is kept in memory and is not stored. Server logs are kept only as long as they are needed to run and secure the service. Legal basis: Art. 6(1)(f) GDPR.

Fonts are served from our own servers. No font is loaded from a third party.

Lookups

When you look up a domain, check where a name is free, or check a list, our server asks the responsible registries and registrars (their WHOIS and RDAP services) about the domain name you entered. They receive the domain name and our server's address, not yours.

We keep a log of lookups: the domain name, the kind of lookup, the result and the time, and - only if you were logged in - your account. The log does not contain your IP address. We use it to see how the service is used and to find faults, and delete entries after 90 days. Legal basis: Art. 6(1)(f) GDPR.

Availability answers are cached on our server for ten minutes, without any reference to who asked.

Tools

The tools under /tools store nothing on our side. They run in one of two places:

  • In your browser. DNS checks are sent by your browser directly to public DNS-over-HTTPS resolvers: Cloudflare (1.1.1.1) and Google Public DNS, and for the DNS propagation check about a dozen public resolvers operated in different countries. Some tools also ask crt.sh (certificate transparency), RIPEstat, Team Cymru or the regional internet registries' RDAP services. These services receive your IP address and the name or address you checked, and process them under their own privacy policies.
  • At the edge. Checks that read another website (HTTP status, headers, redirects, SEO checks) are run from Cloudflare's network. The website you check sees a request from Cloudflare, not from you.

Your account

To track domains you need an account. We store:

  • your email address, your name and your chosen language;
  • your password, only as a salted hash;
  • the domains you track, with the folders, tags and notes you add, and your notification settings;
  • login sessions (refresh tokens), which expire after 30 days;
  • whether and when you confirmed your email address.

We use this data to provide the account (Art. 6(1)(b) GDPR) and keep it until the account is deleted. To delete your account and everything in it, write to us at [email protected] or use the contact form.

In your browser we keep your login tokens and account details in local storage (db_access_token, db_refresh_token, db_user) and, if you choose one, your colour theme (theme). These are strictly necessary for the feature you asked for and need no consent (§ 25(2) no. 2 TDDDG). dotbunker sets no cookies of its own.

Email

We send email to confirm your address, about the security of your account and, if you switch them on, alerts about your tracked domains. Email is delivered through Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg) using Amazon Simple Email Service. AWS processes your email address and the content of the message to deliver it. Legal basis: Art. 6(1)(b) GDPR.

Contact form

When you write to us through the contact form we store your name, your email address, the subject, your message, the language of the page, and your account if you were logged in. We use them only to answer you and delete them once they are no longer needed. Legal basis: Art. 6(1)(b) and (f) GDPR.

Advertising

Sponsor ads are an image and a link served from our own server. Showing them involves no third party and no tracking. When you click one, you go to the advertiser's website, where its own privacy policy applies.

Google AdSense. Some pages may show ads from Google AdSense, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). If you are in the European Economic Area, the United Kingdom or Switzerland, you are asked for your consent first through Google's consent management platform, which follows the IAB Transparency & Consent Framework. With your consent, Google may use cookies and similar identifiers to show personalised ads and measure them; without it, Google shows limited or non-personalised ads. Your IP address and the address of the page you are on are sent to Google in both cases. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw or change your consent at any time through the "Privacy and cookie settings" link at the bottom of any page that shows a Google ad. More in Google's privacy policy and how Google uses data from partner sites.

Pages without an AdSense ad do not load Google's advertising code.

Transfers outside the EU

Cloudflare, Google and Amazon are, or belong to, companies in the USA. Where personal data reaches the USA, the transfer is based on the EU-US Data Privacy Framework, under which these companies are certified, and on the EU standard contractual clauses.

Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on our legitimate interests (Art. 21). Where you gave consent, you can withdraw it at any time with effect for the future. Write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the one where you live or the one responsible for us: the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt), Magdeburg.

Changes

We update this policy when the service changes. Last updated: September 2026.