Privacy Policy

Who we are

HarborDNS is a managed authoritative DNS service operated from Montreal, Quebec, Canada and offered globally. This policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. It applies to our website, the control panel, and the API.

Information you provide

When you create and use an account, you give us:

• Account details — your name, email address, and authentication data such as password hashes and multi-factor settings.
• Billing information — the plan you choose and subscription status. Card and payment details are entered with our payment processor, not stored by us (see below).
• DNS configuration — the zones and records you create, import, or edit.
• Support communications — messages you send us and the context needed to help you.

Information we collect automatically

To operate and secure the service, we record:

• Service and security logs — IP addresses, timestamps, request metadata, authentication events, and API-token activity, used to run the panel, prevent abuse, and troubleshoot.
• Essential cookies — a session cookie and similar technology that keep you signed in and protect against cross-site request forgery. We do not use advertising cookies.

DNS query data

Authoritative DNS is a public system: any resolver on the internet can ask our servers about a domain you host, and those questions are not sent by you. We process query metadata (such as the queried name, record type, timestamp, and requesting resolver address) to answer questions, protect the service against abuse and attack, and operate the service. We do not sell this data or build advertising profiles from it, and we retain detailed query metadata only for the limited period needed for operations and security before it is reduced to aggregate totals.

How we use information

We use information to provide and secure the service, authenticate accounts, operate DNS, process billing, provide support, detect and prevent abuse and fraud, meet legal obligations, and improve reliability and performance. We do not sell personal information.

Payments and service providers

We use a small set of service providers for infrastructure, billing, email, storage, and support. Checkout and subscription payments are processed by Stripe, which handles your payment and checkout information under its own privacy policy; we receive the subscription result, not your full card details. Providers may only process information as needed to deliver their part of the service, and we require appropriate safeguards from them where applicable.

International transfers

HarborDNS serves DNS from globally distributed infrastructure, and our providers may process information in countries other than your own, including Canada and other jurisdictions. Where required, we rely on appropriate legal transfer mechanisms and contractual protections. By using the service, you understand that information is processed in the locations needed to operate it.

Retention

We keep account and configuration information while your account is active. After closure, we retain information only as long as needed for operational continuity, security, dispute resolution, tax and accounting obligations, and other legitimate business or legal requirements, after which it is deleted or de-identified. Detailed security and query logs are kept for a limited operational window and then reduced to aggregates or removed.

Security

We use administrative, technical, and organizational safeguards appropriate to the service, including encryption in transit, hashed credentials, scoped and revocable API tokens, optional multi-factor authentication, access controls, and monitoring. No internet service can guarantee absolute security, but we work to protect information and to respond promptly if an incident occurs. If a breach affecting your personal information happens, we will notify you and any regulators as required by applicable law.

Your choices and rights

You can update your account details, manage multi-factor authentication, and revoke API tokens directly in the panel at any time. Depending on where you live, you may also have the right to request access to, correction of, deletion of, or a copy of your personal information, and to object to or restrict certain processing. To exercise these rights, contact our Privacy Officer below. We may need to verify your identity, and some information must be retained for security, billing, or legal reasons even after an account is closed.

Children

HarborDNS is a service for businesses and technical operators and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will remove it.

Legal requests

We may disclose information when required by valid legal process or to protect the rights, safety, and security of HarborDNS, our customers, and the public. We review requests for validity and disclose only what is legally required.

Privacy Officer

Questions, requests, and privacy concerns can be directed to the HarborDNS Privacy Officer at privacy@harbordns.net. We aim to acknowledge requests promptly and respond within the time required by applicable law.

Changes to this policy

We may update this policy when our service, providers, or legal obligations change. We will post the current version here and update the effective date. Significant changes will be communicated through the service or by email where appropriate.