Privacy Policy | Lemon Domains

This policy explains what data Lemon Domains (“Lemon Domains”, “we”, “us”) collects, why, and what you can do about it. Lemon Domains is a domain portfolio manager. We aim to hold as little of your data as possible and to never sell it.

What we collect

Account information. Your name and email address. If you sign up with an email and password, we store only a hash of your password, never the password itself. If you sign in with Google, we receive your basic Google profile (name, email, and avatar) to create and secure your account.
Portfolio data you provide. The domains, projects, and notes you add, and the registrars and registrar accounts you record, including each account’s label, username, and contact email if you enter them.
Synced and imported domain data. When you import a list or connect a registrar, we store the domain details involved, such as expiry and registration dates, status, auto-renew, nameservers, and lock and privacy settings.
Domain history. A record of changes to each domain (what changed, when, and whether it came from the web app, the MCP server, or a sync). This history is kept even after you delete a domain, so the record of the deletion survives, until you delete your account.
Registrar API credentials. If you connect a registrar, we store the API key and secret (or, for some registrars, the API password or login) you give us, encrypted. See Registrar connections below.
Access tokens. If you create a personal access token for the API or MCP server, we store only a hashed version of it, never the token itself.
Feedback and support messages. Feedback you send from inside the app is stored with your email address so we can reply. Messages sent through the contact form are delivered to us by email.
Account activity. When and how you sign in (for example, with Google or a password), and which days you used the app.
Error logs. When something goes wrong on our servers, we record the error with emails, tokens, keys, and query parameters removed, so we can find and fix the bug.
Email delivery records. For emails we send you, our email provider tells us whether they were delivered, bounced, or marked as spam. We keep the recipient, subject, and status, never the message body.
Usage and technical data. Analytics about how the website and product are used (pages viewed, features used, errors and page performance), plus standard server logs (such as IP address and browser type) needed to run and secure the service. When you are signed in, analytics events are linked to an internal account ID, never to your email address or name, and they do not include your domain names or notes.

Registrar connections

You can connect a registrar account so Lemon Domains can read your domain list for you. Here is what that involves:

Your key is encrypted. The API key and secret (or API password) you enter are encrypted with AES-256-GCM using a key unique to that connection, which is itself encrypted with a master key that exists only in our hosting environment, never in the database.
Only used to call your registrar. Your credentials are decrypted only on our servers, at the moment we call your registrar. We never show them back to you in full (at most a short hint like “…a1b2”) and never write them to logs.
Read-only. We call your registrar’s API once a day, and whenever you click Sync now, to read your domain list. We store what we read (domain names, expiry dates, auto-renew, nameservers, and lock and privacy status) like the rest of your portfolio. We never change anything at your registrar.
Call log. We keep a log of the API calls we make (which registrar, the endpoint path, the response status and timing, and short response excerpts with secrets and transfer codes removed) for 14 days, so you and we can troubleshoot. You can see your own log on the connection’s Activity tab.
Errors. Registrar errors that look like a bug in our code are added to our redacted error log, and may be sent to Anthropic and GitHub by our daily error-triage job (see Service providers).
Your consent. Each connection records when you agreed to the risk notice on the connect form, and which version of it you saw.
Disconnecting. When you remove a connection, we delete its stored credentials straight away (your domains stay in your portfolio). Deleting your account deletes all your connections. We also recommend revoking the key at your registrar.

How we use your data

To provide the service: store your portfolio, sync connected registrars, and surface renewals and expiry.
To send transactional email, such as support replies and notices about your registrar connections.
To respond to support requests and feedback.
To understand product usage and improve the service.
To keep the service secure and prevent abuse.

We rely on our agreement with you (to provide the product), our legitimate interest in running and improving a secure service, and, where required, your consent (for example, analytics cookies).

What we do not do

We do not sell your data, and we do not share it for advertising. Your domain portfolio is yours.

Service providers and other recipients

We use a small number of trusted providers to run the service. They process data only on our instructions. Current providers include:

Neon for database hosting.
Resend for email, such as support and contact replies, a welcome follow-up, and registrar connection notices, and for delivery status.
Google for optional sign-in, and for analytics through Google Analytics and Google Tag Manager.
PostHog for product analytics, error tracking, and session replays. Replays mask form inputs and, inside the signed-in app, all on-screen text, so your domains, notes and registrar details are not recorded; admin pages are not recorded at all.
WorkOS for authenticating MCP connections.
Anthropic and GitHub, which receive redacted error excerpts from our daily error-triage job: Anthropic’s Claude drafts a bug report for each new error, which is filed as an issue in our GitHub repository.
Our hosting and content-delivery providers, which run the application and serve it to your browser.

Some data also goes to services that are not our providers:

Registrars you connect. Requests made with your credentials go to the registrar you connected, and are covered by that registrar’s own privacy policy.
rdap.org and Cloudflare (DNS-over-HTTPS), which receive the domain names you enter into our free tools, such as WHOIS, DNS, SSL, and email checks, so we can look them up.

This list may change as the product evolves. Data may be processed in countries outside your own, including the United States.

Cookies and analytics

We use essential cookies to keep you signed in and to operate the app. These are always on.

We also use analytics cookies and similar storage from Google Analytics (loaded through Google Tag Manager) and PostHog to measure usage and find problems. We do not use advertising cookies. If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics only run after you accept them in the cookie banner. Everywhere else they are on by default. Wherever you are, you can turn them off at any time:

When you are signed in, we also record a small number of product events on our servers (for example, that a domain was added or an import finished) and send them to PostHog with your account ID, so we can keep the service working and understand which features are used. PostHog also keeps your email address on your analytics profile so we can see which account activity belongs to; it is never attached to individual events. These use no cookies. You can also block cookies in your browser, though essential cookies are required for the app to function.

Data retention

We keep your data while your account is active. Some records are deleted sooner:

Registrar API call logs: 14 days.
Error logs: 30 days.
Email delivery records: 90 days.
Registrar credentials: deleted as soon as you remove the connection.

When you delete your account, we delete your portfolio data, domain history, registrar connections, and the other data linked to your account, subject to short retention in backups and any records we must keep for legal reasons.

Your rights

You can access, correct, export, or delete your data at any time. Portfolio data can be exported as CSV from inside the app. To exercise any other right, or to delete your account entirely, email us at hello@lemon.domains. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, and we will honour them.

Security

We encrypt data in transit, encrypt registrar credentials at rest, store passwords and access tokens only as hashes, remove secrets from logs, and restrict access to your data to what is needed to run the service. No system is perfectly secure, but we take reasonable measures to protect your information.

Children

Lemon Domains is not directed at children and is not intended for anyone under 16. We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for material changes, give notice in the app or by email.

Contact

Questions about privacy? Email hello@lemon.domains, or see our Terms of Service.