Privacy Policy

Last updated October 6, 2026

This policy explains what data Domain Forward collects, why, who processes it for us and what you can ask us to do with it. It covers the website (domain-forward.com), the app (app.domain-forward.com), the REST API, the free tools (tools.domain-forward.com) and our MCP servers for AI assistants such as ChatGPT and Claude.

Who we are

Domain Forward is operated by Ekke OÜ, registry code 14078916, Mustamäe tee 128-5, 12911 Tallinn, Estonia. We are the controller of the personal data described here.

For any privacy question or request, email info@domain-forward.com.

What we collect and why

Your account

When you sign up we store your email address, your name and how you sign in (email and password, or Google). We also store your answers to the signup questions and which teams you belong to. We use this to run your account, to let you work with your team and to understand who uses Domain Forward. New signups are posted to an internal team channel so we can help new users get started.

Sign-in is handled by Google Firebase Authentication. Passwords are never visible to us.

Your redirects and domains

We store the redirects and domains you add, the state of their DNS setup and any site migration plans you create. We need this data to serve your redirects. It stays in your account until you delete it or delete the account.

Redirect traffic analytics

For each redirect we count requests per day, broken down by source host, destination host, country and referring host. For catch-all redirects we also record which paths were requested. We don’t store the IP addresses or browser details of the people who visit your redirects.

The AI assistant in the app

If you use the AI assistant inside the app, your messages and the account data the assistant reads to answer you (for example your redirects and their status) are sent to Anthropic, which provides the Claude model behind it. Anthropic processes this data on our behalf to generate the answer.

Free tools and MCP servers

The free tools on this website and the free tools MCP server work without an account. When you run a check we process the domain or URL you entered. To answer, our servers contact public DNS resolvers, domain registration (RDAP) services and the website you are checking. Results are cached in memory for 30 to 60 seconds so repeated checks are fast. Our servers log requests, including the requesting IP address, to enforce rate limits and stop abuse.

Connected apps (MCP and OAuth)

You can connect ChatGPT, Claude or another app to your account through our MCP server. The app gets access only to your team and only with the read or write permissions you approve. You can see and revoke connected apps in your account settings at any time. API keys and access tokens are stored only as hashes, so we can’t read them back.

One-click DNS setup

If you connect your DNS through Cloudflare, the API token you enter is used for that single request and is never stored. With Domain Connect we send you to your DNS provider, which makes the change on your instruction.

Billing

Payments for paid plans are handled by Chargebee and its payment processors. We see your plan, invoices and billing details, but never your full card number.

Error reports and session recordings

We send error reports from the app and our servers to Sentry so we can fix bugs. In the app we use FullStory to record sessions, which shows us how people use the interface and where they get stuck.

Website analytics

If you accept analytics cookies on this website, we use Google Analytics to see which pages people visit, how they got here and roughly where they are. Google Analytics doesn’t log or store IP addresses. If you reject or ignore the cookie banner, Google Analytics isn’t loaded at all.

Support chat

The chat widget on our website is provided by Tawk.to. If you start a chat, your messages and the details you share are stored by Tawk.to so we can answer you.

Who processes your data

We use these service providers. Each only gets the data it needs to do its job for us.

  • DigitalOcean: hosting for the app, API, free tools and database
  • BunnyCDN: delivery of the website and the app’s files
  • Google Cloud: sign-in (Firebase Authentication) and other infrastructure
  • Google Analytics: website analytics, only with your consent
  • Anthropic: the AI assistant in the app
  • Chargebee: subscriptions and payments
  • Sentry: error reports
  • FullStory: session recordings in the app
  • Tawk.to: support chat
  • Zoho: our email, including the messages you send us
  • Slack: internal notifications about new signups

We don’t sell your data and we don’t share it for advertising.

International transfers

Several of these providers are based in the United States or store data there. Where data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

How long we keep data

  • Account data, redirects, domains and analytics: while your account exists, and deleted within 90 days after you delete it, including backups.
  • Server request logs: 90 days.
  • Free tool results: cached in memory for under a minute.
  • Invoices and billing records: as long as accounting law requires.
  • Support chats and error reports: as long as needed to resolve the issue, and no longer than 90 days for error reports.
  • Website analytics in Google Analytics: 14 months.

Cookies and local storage

The website and the app use only what they need to work and to help us improve them:

  • Firebase stores your sign-in session in the app so you stay logged in.
  • The app remembers your theme choice in your browser.
  • FullStory and Sentry set their own cookies or storage in the app for session recording and error reports.
  • Tawk.to sets cookies on the website to keep your chat going between pages.
  • If you accept analytics cookies, Google Analytics sets _ga cookies on the website, which last up to two years. Your choice is saved in your browser.

You can change your choice at any time with the “Cookie settings” link at the bottom of every page. If you withdraw consent, we delete the Google Analytics cookies.

We don’t use advertising cookies.

Your rights

You can ask us for a copy of your data, to export it, to correct it or to delete it. You can also object to how we use it or ask us to restrict it. Email info@domain-forward.com from the address on your account and we’ll answer within 30 days. You can delete your redirects, domains and connected apps yourself in the app at any time.

If you’re in the European Union, you can also complain to your local data protection authority.

Our legal basis

We process account, redirect, billing and AI assistant data to provide the service you signed up for (performance of a contract). We process analytics, error reports, session recordings and request logs because we have a legitimate interest in running a secure, working service. We use Google Analytics on the website only with your consent, which you can withdraw at any time. We keep invoices because the law requires it.

Security

All traffic to our services is encrypted with HTTPS. API keys and tokens are stored as hashes, access to production systems is limited to the people who need it, and connected apps only get the permissions you grant.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your data in a significant way, we’ll email account owners before it takes effect.