Privacy Policy
Last updated August 2026.
Short version: we collect what we need to run the service, we do not sell it, and we do not put trackers on your site.
What we collect
| Data | Why |
|---|---|
| Name and email address | To identify your account and send verification and password-reset emails. |
| Password (hashed) | To sign you in. We store a one-way hash and never the password itself. |
| Subdomains and DNS records | They are the service. We must store them to publish them. |
| IP address and timestamps | Audit logs, rate limiting and abuse investigation. |
| Abuse reports | To investigate and act on reported subdomains. |
| Sign-in times | Signing in renews your subdomains, so we record when it happened. |
What we do not do
- We do not sell or rent your personal data.
- We do not inject ads, analytics or tracking scripts into your site.
- We do not read the content you host — we do not host it.
Who else sees it
- Nobody, for DNS. We run the authoritative nameservers for
ajaira.siteourselves, so your records are not handed to a third-party DNS provider. They are of course published to the world — that is what DNS is. - Our email provider receives your email address so verification and reset messages can be delivered.
- Our hosting provider operates the servers the application runs on.
We share data with nobody else unless we are legally required to.
DNS is public
Anything you publish in a DNS record is public by design. Anyone can query it. Do not put secrets in TXT records.
Cookies
One session cookie, set when you sign in, so the site knows it is still you. It is
HttpOnly, SameSite=Lax and marked Secure over HTTPS.
There are no advertising or analytics cookies.
How long we keep things
- Account data: while your account exists.
- DNS records: until you delete them or release the subdomain.
- Audit logs and abuse reports: retained after deletion so we can investigate repeat abuse.
- Rate-limit counters: hours, then discarded.
- Expiry reminders: sent to your account email while you hold a subdomain.
Your choices
- Update your name from account settings.
- Delete any DNS record or release any subdomain at any time.
- Ask us to delete your account by writing to
privacy@ajaira.site. We will remove your account and subdomains; minimal records tied to abuse enforcement may be kept.
Security
Passwords are hashed. DNS operations are authorised server-side against the subdomain you own.
The nameserver API is reachable only from our application server and is never exposed to
users. No system is perfect — if you find a vulnerability, write to
security@ajaira.site and we will credit you.
Contact
privacy@ajaira.site