Privacy Policy

Unclaimed by AI (“we”, “us”) operates the name-checking service at unclaimedbyai.com (the “Service”). We help founders and creators check domains, social handles, and AI associations before building around a name.

For data-protection purposes we are the data controller for the personal data described in this policy. You can reach us at [email protected].

We collect the minimum needed to run the Service:

• Account data. Your email address when you sign in with a magic link or Google, plus basic profile details Google shares (like your name) if you choose that option.
• Names you check. Every name, brief, search, and check you run, including the results we generate for you.
• Purchase data. Which credit packs you buy and your credit balance. Payments are processed by Stripe — we never see or store your card number.
• Technical data. Standard server logs (IP address, browser type, pages visited, timestamps) for security and debugging.
• Waitlist data. Your email if you join the waitlist, used only to notify you about launch.

We use your data to:

• Run domain, social-handle, and AI-association checks you request.
• Create and maintain your account and sign-in sessions.
• Process payments and manage your credits through Stripe.
• Send transactional emails (magic links, receipts) and, rarely, product updates.
• Keep the Service secure, fix bugs, and understand aggregate usage.

Our legal bases are performance of our contract with you, our legitimate interests in operating and securing the Service, and your consent where you give it (for example, marketing emails, which you can opt out of at any time).

This one deserves its own section because it surprises people. To tell you what AI models already associate with a name, we send that name to third-party AI providers (via OpenRouter) and ask what they know about it. Their responses become part of your check results.

That means every name you check is shared with AI model providers, and their own privacy policies apply to that data. Please don't check names containing passwords, secrets, or other sensitive information — the checker is for brand names you're considering, and you should treat anything you type as non-confidential.

Domain availability is checked against public registration data (RDAP/WHOIS), and social handles against the platforms' public APIs. Those queries are inherently public — a registry or platform can see that someone looked up that name.

We use a small, honest set of cookies:

• sid — your sign-in session (30 days, strictly necessary).
• tb — a one-hour marker that you've passed our Cloudflare bot check, so it doesn't nag you repeatedly (strictly necessary).
• uba-consent — remembers the choice you make in the cookie banner for a year (strictly necessary).
• bid — makes sure a boost you send counts once (two years).
• uba-pending-plan — carries your selected credit pack through checkout (one hour, strictly necessary).

Some pages load Cloudflare Turnstile to verify that requests come from humans rather than bots. We also use privacy-friendly, first-party analytics (no cross-site identifiers) to understand aggregate usage — it only loads if you allow it in the cookie banner, and declining it doesn't limit the Service in any way.

On top of that, the app sends a small number of first-party usage events to our own servers — which page you were on and which action you took (for example, that a search finished), never the text you typed. They run on the session above, set no cookies, involve no third parties, and exist so we can see where the product helps and where it gets in the way.

We do not use advertising cookies or cross-site trackers. If that ever changes, we'll update this policy and ask for consent where the law requires it.

We share data only with the service providers that operate the Service, each limited to what they need:

• Cloud hosting and database providers that store and serve the app and your data.
• Resend (transactional email) for magic links and receipts.
• Stripe (payments) for checkout and billing.
• OpenRouter and AI model providers for AI-association checks, as described above.
• Google, only if you choose Google sign-in.

We do not sell personal data, share it with advertisers, or use it for any purpose outside operating the Service. We may disclose data if required by law or to protect our rights, and we'll push back on overbroad requests where we can.

When a check shows a domain is free, some of the links to registrars on that page are affiliate links. If you follow one and register the name, the registrar may pay us a commission. Your price is identical whether you use our link or type the domain into the registrar yourself, because the commission comes out of the registrar's marketing budget, not your pocket.

Two things we won't do. We won't let a commission change a result: the extensions we show as free are the ones the check actually found free, whether or not a registrar on that list pays us. And we won't pretend the link isn't a link. Wherever one appears, it says so.

Registrars we may link this way include Namecheap, GoDaddy, and Dynadot. The same goes for any register link we send in a watch-alert email.

We keep account data, searches, and checks for as long as your account is active, so your history is there when you return. Server logs are kept for a limited period for security and debugging, then deleted or anonymized.

You can request deletion of your account and associated data at any time by emailing [email protected]. We'll delete your personal data within 30 days, except where we must retain records for legal, tax, or fraud-prevention reasons (for example, payment records).

We protect your data with encryption in transit (TLS) and at rest, least-privilege access to production systems, and scoped credentials for third-party services. Sessions expire, magic links are single-use and short-lived.

No system is perfectly secure. If you discover a vulnerability, please report it to [email protected] and we'll respond promptly.

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise any of these rights, email [email protected].

If you're in the EU, UK, or Switzerland, this includes your GDPR rights (access, rectification, erasure, restriction, portability, objection) and the right to lodge a complaint with your supervisory authority. If you're in California, this includes your CCPA rights to know, delete, and opt out of sale — and to be clear, we do not sell personal information.

The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we'll delete it.

We may update this policy as the Service evolves. Material changes will be announced by email or in-app notice before they take effect, and the “last updated” date above will always reflect the current version. Continued use of the Service after changes take effect means you accept the updated policy.

For any privacy question, request, or complaint, email [email protected]. We aim to reply within a few business days.