Privacy policy
Last updated: October 21, 2026
This policy explains what Front Sentinel ("we", "the service") collects when you use frontsentinel.com, the free scanner, the dashboard and the Telegram bot @front_sentinel_bot, why, and how long we keep it. The service is run by the Front Sentinel project, which is not a registered company.
What we collect
Free scan, no account. The domain name you scan and the scan result (public DNS, registry and website data). We log the domain and the time of each scan for usage statistics. To enforce rate limits we keep your IP address (for IPv6, the /64 network) for up to 24 hours. We do not link scans to a person.
Account. Your email address, which is also how you sign in. We email you single-use sign-in links. The sign-in cookie holds a random session identifier. We store only its hash, and the session lasts 30 days.
Monitoring. The domains and frontend URLs you add, the snapshots we take of them (DNS records, registry data, certificates from public Certificate Transparency logs, hashes of your public pages and scripts), and the events we detect.
Alert channels. The email addresses, webhook URLs and Telegram chat IDs you configure, plus a delivery log for each alert (time, status, error text with tokens removed).
Support. The email address and message you send through the contact form.
Payments. For a paid plan: the order (plan, period, exact amount) and the matching on-chain transaction (network, token, transaction hash, sending address, amount). This data is public on the blockchain anyway. We never ask for private keys, seed phrases, wallet connections or registrar logins.
We do not use analytics, advertising or tracking cookies, and we do not sell or rent data.
Why we use it
To run the scans and monitoring you asked for, deliver alerts, sign you in, apply plan limits, match payments to orders, answer support requests, and protect the service from abuse. Where a legal basis is required, it is the performance of our agreement with you, and our legitimate interest in keeping the service secure.
Who else processes it
- Hosting: our server is with a data-center provider in the EU (Germany).
- Email delivery: Resend (resend.com) sends sign-in links and email alerts, so it receives the recipient address and the message.
- Telegram: alerts to Telegram pass through Telegram's Bot API.
- Webhooks: alerts are posted to the URLs you configure (for example Discord or Slack).
- Public data sources: to check a domain we send its name to public DNS resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9), to registry RDAP servers, and to Cert Spotter (SSLMate) for Certificate Transparency. These requests carry the domain name, not your identity.
- Blockchain data: we read public explorer and RPC endpoints to detect payments.
- DNS for frontsentinel.com: Cloudflare.
How long we keep it
- Rate-limit records: 24 hours.
- Sign-in links: deleted one day after they expire (they expire after 20 minutes). Sessions: deleted when they expire (30 days).
- Domains, snapshots and events: while the domain is in your account. Removing a domain deletes its snapshots and events.
- Alert channels: until you remove them.
- Support messages: 12 months.
- Orders and payment records: 6 years.
- Account: until you delete it. Use "Delete account" in the dashboard, which takes effect immediately, or ask us and we delete it within 30 days. Its domains, snapshots, events, channels and sessions go with it. Payment records are kept as described above.
Your choices and rights
You can remove domains and alert channels in the dashboard at any time. You can delete your account in the dashboard. To get a copy of your data or correct it, write to us through the contact form from your account email. If you are in the EU or UK, you can also complain to your local data protection authority.
Security
Traffic is encrypted with TLS. Session and sign-in tokens are stored only as hashes. Access to the server is restricted. No system is perfectly secure. If a breach affects your data, we will tell you by email.
Children
The service is for businesses and developers, not for children under 16.
Changes
We will post changes on this page and update the date above. If a change is significant, we will email account holders before it takes effect.
Contact
Use the contact form.