Privacy Policy
Last updated: 6 September 2026
This policy explains what TLDSpy collects, why, how long it is kept, and what you can ask us to do about it. It covers tldspy.com and the TLDSpy API.
1. Who is responsible
The data controller is Hive Horizon, 61 rue de Lyon, 75012 Paris, France (SIREN 979 357 324). For any question about this policy or to exercise your rights, write to [email protected].
2. What we collect, and why
If you only browse the site
You do not need an account to browse pricing pages, guides or comparisons. We do not ask for anything about you to do so.
If you search a domain
- The domain you search is sent to our server, used to query public WHOIS and RDAP records, DNS, and our pricing index, and returned to you.
- If you are signed in, the search is saved to your own history so you can find it again. You can delete any entry, or turn history off entirely with private search mode.
- If you are not signed in, the search is not attached to any account. We count anonymous searches against a daily limit to prevent abuse.
If you use the Domain Cost Audit
The domains you paste into the audit tool are used to answer that one request and are then discarded. Your list is never written to our database, never attached to an account, and never shared with registrars or anyone else. No account is required.
If you create an account
- Your email address, used to sign you in and to contact you about your account. We sign in with a link sent by email, so we never store a password.
- Your API key and usage counters, to authenticate requests and enforce the limits of your plan.
- Your search history and preferences (favourite registrars, private search mode), so the product behaves the way you left it.
If you subscribe to a paid plan
Payments are handled by Stripe, which acts as payment processor. Your card details go to Stripe and are never seen or stored by us. We keep the identifiers Stripe returns, plus your plan and its renewal date, so we can give you the access you paid for and meet our accounting obligations.
Technical logs
Our servers record request logs, including IP addresses, to keep the service running, enforce rate limits and investigate abuse. These are kept for a limited period and are not used to profile you.
3. Analytics, and your choice
We measure how the site is used so we can fix what is broken. What runs depends on where you are and what you chose.
| Tool | Provider | What it does | Consent |
|---|---|---|---|
| Umami | Self-hosted by us | Counts page views. Sets no cookie, does not track you across sites, and the data never leaves our own server. | Not required |
| Google Analytics 4 | Google Ireland Ltd | Audience measurement: pages viewed, journeys, approximate location. | Required |
| Microsoft Clarity | Microsoft Corp. | Aggregated heatmaps and session replays, to see where people get stuck. | Required |
Google Analytics and Clarity are not loaded at all until you accept them. They are not merely paused: the scripts are absent from the page. Both providers may transfer data outside the European Union, under the safeguards their own terms describe.
What Clarity never records
Session replay films the page, so we deliberately keep your data out of it. The following are masked before anything is sent, and appear as blocks rather than text:
- Domains you type or paste, in the search box and the audit tool
- Search results, search history and audit results
- Your API key on the account page
Clarity is also switched off entirely on
/search and the admin area, because
those addresses can contain a domain you searched.
Changing your mind
Use the Cookies link in the footer, at any time. Refusing analytics never affects your ability to sign in or use the site: sign-in and your saved choice are strictly necessary and are never part of the decision.
4. Cookies and local storage
| Name | Purpose | Kept for |
|---|---|---|
consent_prefs | Remembers your analytics choice, so you are not asked again. Strictly necessary. | 6 months |
token, user | Keeps you signed in. Stored in your browser, not sent as a cookie. Strictly necessary. | Until you sign out |
| Google and Microsoft cookies | Analytics, set only if you accept. | Per provider, up to 2 years |
5. Affiliate links
Some links to registrars are affiliate links, and we may earn a commission if you register a domain after following one. This never changes the prices we show you or the order in which registrars are ranked. Once you leave for a registrar's site, that registrar's own privacy policy applies.
6. Who else sees your data
We do not sell your data, and we do not share it for advertising. Besides the analytics providers listed above, it reaches only:
- Hetzner Online GmbH (Germany) — hosting
- Stripe — payment processing, for paid plans
- Public registry sources (WHOIS, RDAP, DNS), which receive the domain being looked up and nothing about you
7. How long we keep it
- Account data — while your account exists, then deleted or anonymised.
- Search history — until you delete it or close your account.
- Audit submissions — not kept at all.
- Billing records — as long as accounting law requires.
- Your analytics choice — 6 months, then we ask again.
8. Your rights
Under the GDPR you may ask for access to your data, correction, deletion, a portable copy, restriction of processing, and you may object to processing. Where we rely on your consent, you may withdraw it at any time.
Write to [email protected]. If you are not satisfied with our answer, you may lodge a complaint with the CNIL (cnil.fr).
9. Changes
If we add or change a tool that collects data, we update this page and ask for your analytics choice again. The date at the top always reflects the current version.
See also our Terms of Service and Legal notice.