Privacy Policy

Who we are

DNS Aman is developed and maintained by Nuvira Komunika Solusi (nuvira.co.id).

Needs legal review: legal entity name, registered address and the contact for privacy requests.

What DNS Aman stores about you

• Your username and role, and the domains your account is allowed to manage.
• Your password, stored only as a salted scrypt hash. We cannot read it.
• If you turn on two-step verification, the secret your authenticator app uses.
• When you last signed in.
• An activity record of changes made through the console or API: who made the change, when, what changed, and the IP address the request came from. Failed sign-in attempts are recorded the same way.
• The DNS zones and records you create, including origin addresses for proxied records.
• API tokens, stored only as a hash, with their name, permissions, allowed IP ranges, expiry and when they were last used.

Cookies

The console sets one cookie, which keeps you signed in. It is encrypted, cannot be read by scripts on the page, and expires after 8 hours. The public website at dnsaman.com sets no cookies. Neither uses advertising or analytics trackers, and no third-party scripts are loaded.

DNS query data

DNS Aman's nameservers answer queries for the domains it hosts. The platform keeps aggregate counters of those queries (totals by record type and response code) to show service health to its operators. It does not build profiles of the people or systems that send queries.

Needs legal review: whether nameserver query logs are retained, for how long, and on what basis.

How long data is kept

Today, account data and DNS records are kept until an administrator deletes them, and activity records are kept indefinitely. Sign-in sessions end after 8 hours or when you sign out.

Needs legal review: a retention period for activity records and deleted accounts, and how deletion requests are handled.

Who can see your data

People with access to a domain in DNS Aman can see its records and its activity history. Platform administrators can see all accounts, domains and activity records in order to run the service. Records you publish are, by the nature of DNS, visible to anyone on the internet; proxied records publish the proxy address instead of your origin.

Needs legal review: subprocessors (for example hosting providers and their locations) and any legal basis for transfers.

Your rights and contact

Needs legal review: the rights available to users under applicable law (for example Indonesia's Personal Data Protection Law) and how to exercise them.