Privacy
DNSalsa keeps a hostname pointed at your IP address. To do that it has to store that IP address, and a few things about your account. This page lists all of it.
Who is responsible
DNSalsa is run by iapp B.V., registered with the Dutch Chamber of Commerce (KvK) under number 42166243, Burcht 42, Veldhoven, the Netherlands. The B.V. is the controller for the personal data described here under the GDPR (AVG). For any question or request about your data, email [email protected].
This policy covers the dnsalsa.nl website, the dashboard and the DNSalsa service itself. It does not cover what our users run at their own addresses, such as yourname.dnsalsa.nl: a Home Assistant or other service there belongs to that user, who decides what it collects. DNSalsa only points the name at it, and for a tunnel passes the traffic on without storing it.
What we store
| Data | Why | How long |
|---|---|---|
| Account: username, email address, whether you confirmed it, passkey public keys | To let you sign in with your passkey, to send you a link if you lose it, and to contact you about your account. We never receive your passkey's private key or any password. | Until you delete your account |
| Confirmation and recovery links (stored as a hash) | So a link works once and only for your account. | Until the link expires, then 30 days |
| Hostnames and update tokens | To know which hostnames are yours. Tokens are stored as a hash, never in plain text. | Until you delete the hostname or your account |
| Current IPv4 and IPv6 address per hostname | This is the service itself: we publish it as a public DNS record. | Until the next update, or until the hostname is deleted |
| Tunnel settings (only if you use a tunnel): the service address you enter and the Cloudflare tunnel ID | To route traffic for your hostname to your machine. | Until you switch the hostname back to dynamic DNS or delete it |
| Discord webhook, Telegram chat ID and name (only if you set them up), your notification choices | To send you the notifications you asked for. | Until you remove the webhook or delete your account |
| Subscription (only if you pay for one): Stripe customer and subscription ID, plan, status, renewal date | To know which tunnels you paid for, and to pause or resume them. | Until you delete your account |
| Billing details, stored at Stripe and visible to us there: name, email address, billing address (street, postcode, city, country), the last 4 digits of your IBAN or card, payment history | To charge the subscription, send invoices and handle failed payments or refunds. The country also decides which VAT applies. | As long as you have a subscription, then as long as the invoices below |
| Invoices and payment records: name, billing address, amount, date, VAT | Dutch tax law requires us to keep them. | 7 years |
| Update history: time, old and new IP, IP and user agent of the client that called the update | So you can see when your address changed, and so we can spot a stolen token. | 90 days |
| Web server logs: IP address, time, requested page | To keep the service running and to stop abuse. | 14 days |
A hostname's IP address is public by design. Anyone can look up myhome.dnsalsa.nl and see the address it points to, just like any other DNS record.
Legal basis
We process your account, hostnames, current IP addresses and subscription because you asked us to provide the service (Article 6(1)(b) GDPR). We keep invoices because the law requires it (Article 6(1)(c) GDPR). We keep the update history and server logs because we have a legitimate interest in securing the service and detecting misuse of tokens (Article 6(1)(f) GDPR).
Who else sees it
DNSalsa runs on our own server in the Netherlands. Everything we store, as listed above, sits on that server. These outside parties are involved:
- Cloudflare hosts the dnsalsa.nl DNS zone and sits in front of the website. It receives the IP addresses we publish as DNS records, and the IP address of every visitor and update call. For a hostname that uses a Cloudflare Tunnel, all traffic to that hostname passes through Cloudflare, which decrypts it and sends it on to your machine. Cloudflare is a US company and transfers data under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
- Stripe, only if you start a subscription. Stripe handles the payment. It receives your name, email address and billing address, and depending on how you pay: with iDEAL and SEPA Direct Debit your bank, account holder name, IBAN and the direct debit mandate (including the date and the IP address you accepted it from); with a card the card number, expiry date and security code. Stripe sends us the result and the details in the table above. We never see your full IBAN or card number. Stripe is the controller for the payment data it needs for its own legal duties, such as fraud checks. Stripe Payments Europe is based in Ireland; data that goes to Stripe in the US is covered by the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
- Lettermint (Lettermint B.V., the Netherlands) delivers the confirmation, recovery and security emails we send you, and the notifications you switch on. It receives your email address, your username and the content of those emails, processes them on servers in the EU and works for us under a data processing agreement.
- Telegram, only if you connect the DNSalsa bot. Telegram then knows that your Telegram account receives messages from DNSalsa, and receives the content of the notifications: your hostnames, their IP addresses and tunnel status. We store your Telegram chat ID and display name to know where to send them, until you disconnect. Telegram's own privacy policy applies to those messages.
- Discord, only if you add a Discord webhook. The messages we send there contain your hostnames, their old and new IP addresses, the IP address an update came from, and tunnel status. Discord's own privacy policy applies to those messages, and so does the visibility of the channel you picked.
- Anyone on the internet can resolve your hostname and see its current IP address. That is how DNS works.
We don't sell your data, show ads or share your data with anyone else.
Cookies and tracking
The dashboard sets one session cookie so you stay signed in. It is strictly necessary and needs no consent. The public pages set no cookies and load no analytics, fonts or scripts from other sites.
Your rights
You can ask to see, correct, export or delete your data, and you can object to processing based on legitimate interest. Deleting your account removes your hostnames and their DNS records right away, and the update history with them. Invoices stay for the 7 years the law requires. Cancel a subscription first under Manage subscription. Send your request to [email protected] and we answer within one month.
If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
If this page changes in a way that affects you, we email account holders before the change takes effect. The date at the top shows the last update.