Privacy policy

Datante (“Datante,” “we,” “our,” or “us”) operates the website datante.com and the associated home-network privacy service. Our service routes your home router’s DNS through filtering profiles we manage on your behalf to block trackers built into smart-home and IoT devices.

We collect the minimum information needed to operate your account and provide the service:

Optional provider detection runs only when you click Detect provider. Datante checks trusted request egress against an IPtoASN database stored on our server; your IP is not sent to an ISP lookup service. The hint contains only a network-owner name and an advisory warning, not your address or location, and is not saved. A network owner may differ from your retail internet provider. Manual corrections last only for this visit. Missing, corrupt or more-than-seven-day-old data makes lookup unavailable without an external fallback and never blocks setup. We download the public dataset over HTTPS using the server's address, without customer IPs, account identifiers or credentials. The former automatic provider lookup after IP authorization is removed; existing stored ISP metadata remains unchanged and unverified.

During setup, this browser contacts icanhazip.com’s IPv6-only web endpoint to check browser-to-web IPv6 reachability. That third-party service can see the request address; Datante does not save the response address as part of the network check. If needed, you may enter the router WAN IPv4 address so Datante can compare it with trusted request egress; the entered WAN value is not saved. If IPv4 authorization is needed, the raw value is passed only with the router-selection request and compared with trusted egress from that same request before authorization; it is never written to your profile or history. These are limited network compatibility signals, not DNS-transport proof or a confirmed CGNAT diagnosis. When IPv4 and IPv6 are both in use, router setup calls for both assigned Datante resolver families from the same household endpoint. Fresh strict verification is required for every household, including existing accounts; older setup or provisioning records alone are not proof of protection.

A fresh authenticated client check uses a one-time challenge, matches a canary request in the expected resolver log, and checks the expected blocking behavior. A browser’s own DNS-over-HTTPS (DoH) request could explain that log entry, so it does not prove that the operating system or router used native DNS, which transport family carried the query, or that every physical device uses Datante. Current canary evidence leaves both public IPv4 and dual-stack installations incomplete: native IPv4 DNS transport is unproven for public IPv4, and native IPv4 and IPv6 DNS transport are unproven for dual-stack. An HTTP connection’s address family is not DNS-transport proof, and no family is inferred from the canary result. To rerun a check after a router, provider, or DNS change, open Dashboard → Account → Network. A check from another network never changes your saved Home network, router settings, or filtering policy.

• Email address — to create your account and send transactional messages (such as payment receipts).
• Subscription status — whether your subscription is active or inactive, and your chosen privacy preset (Light, Balanced, or Strict).
• DNS device ID — a randomly generated identifier used to route your router’s DNS queries to the correct filtering configuration.
• Stripe customer ID — a reference ID used by our payment processor to manage your subscription. We do not store full payment card details.
• Raw DNS activity — Raw DNS logs are detailed, itemized records of DNS requests that reach Datante's resolver. They contain the exact requested domain name, precise timestamp, device/client identity when supplied, source IP address, and recorded action, such as blocked, allowed, or redirected. They support household visibility and troubleshooting. They do not capture every Internet request, full URLs, page contents, or messages.
• Private household summaries — saved request and blocked counts, domains, time-based breakdowns, and client/family references used by the dashboard. These remain associated with your household resolver; they are not anonymous service-wide analytics.

DNS metadata can reveal sensitive information about services your devices contact, including background activity. We do not require your name, phone number, or home address to provide DNS filtering.

We are explicit about this because it matters:

• Website content — DNS filtering works with domain lookups. It does not inspect page contents, full URL paths, messages, or files. DNS requests that bypass Datante are not visible in its resolver logs.
• Not a complete browsing history — a DNS lookup does not prove that someone visited a website. Devices also make background requests, and multiple devices may share one router or resolver identity. Logs are not an exact physical-device inventory.
• IP addresses — We do not use IP addresses for tracking, advertising, or profiling. The current public IPv4 observed from trusted request egress may be kept in the latest operational network-check profile for setup and recovery; it is not copied into the categorical diagnostic history or product-usage analytics. DNS activity logs can separately contain source IP addresses. Your entered router WAN value is never stored or logged. We keep a saved set of public Home addresses to classify home/away DNS activity. Router setup can establish the first Home address; Account → Network can add another only after a fresh matching check and your explicit confirmation. Previous Home addresses remain Home. Dashboard visits and ordinary connection checks never change this set. The update shows only the saved count and time, not the saved addresses. We also keep a short-lived security request log that includes IP addresses solely for abuse prevention — see “Security and abuse-prevention logging” below. It is not used for tracking and is deleted after 30 days.
• Physical device inventory — Datante does not scan for MAC addresses, hardware identifiers, or browser fingerprints to build a device inventory. When the dashboard sees a service used only by a particular family of smart-home hardware, it may show an aggregate “Confirmed family” label. If multiple independent, reviewed signals agree, it may show “Likely family.” One reviewed but weaker hardware hint may show “Possible family.” An allowlisted hardware-family name from an older saved summary may show “Historical inference” when current classification-only routes still agree with that same family; current evidence, operator overrides, and different-family classifications replace it. Incomplete old rows retain exact saved family totals but never invented route or blocked-count detail. None is an exact model, individual unit, physical inventory, or device count. General vendor websites, streaming apps, shared cloud services, and advertising domains do not qualify. Unreconciled historical groups and activity that cannot be named remains in one “Other Unrecognized Devices” group instead of being tied to a physical device or person. This inference does not use source-IP identity, router client lists, MAC addresses, browser fingerprints, or hardware identifiers.

We use the data we collect exclusively to:

• Create and maintain your account.
• Provision and manage your DNS filtering profile with the privacy rules you selected.
• Process subscription payments and send payment-related emails via Stripe.
• Provide customer support when you contact us.
• Show household DNS activity and troubleshoot filtering or connection problems.
• Comply with legal obligations.

We do not sell your data, share it with advertisers, or use it for any purpose beyond operating the service.

To provide the service, we share limited data with the following trusted third parties:

• Supabase — hosts our database (email, subscription status, profile IDs, and private dashboard summaries). Data is stored in the US and protected by row-level security. See Supabase’s privacy policy.
• Stripe — processes subscription payments. We share your email with Stripe so they can send payment receipts. We do not store your card number. See Stripe’s privacy policy.
• DNS infrastructure provider — provides the DNS resolver infrastructure that processes your router’s filtering queries. DNS analytics is enabled during provisioning to support activity views and troubleshooting. Raw query logs are available when detailed analytics is enabled. The provider's documented retention limits are explained below; they do not cover copies saved by Datante.

Documented provider limits: Our DNS infrastructure provider documents a maximum of 1 month for raw query logs when detailed analytics is enabled and 1 year for other statistics. Those statistics are not automatically anonymous or service-wide. These documented limits are not independent verification of erasure from every provider copy or backup.

Separate data categories: account records, billing, saved filtering settings, setup diagnostics, security logs, and product-usage events have the separate purposes and retention rules described here. They are not reclassified as anonymous DNS totals. Opting out of product activity recording does not disable DNS query logging.

We retain your account data (email, subscription status, DNS device ID) for as long as your account is active. If you cancel your subscription and request account deletion, we will delete your account data within 30 days, except where retention is required by law (e.g., invoice records required for tax compliance, which are retained for 7 years).

To support setup and recovery, the household account also keeps its latest network-check profile, including the current public IPv4 observed from trusted request egress when available, its evidence method/confidence/provenance, categorical address-family, WAN-comparison, authorization, verification, and failure statuses; and the household endpoint assignment reference needed to operate the service. The entered WAN value and DNS query history are not stored in that diagnostic profile. IPv6 source-address and global status remain unknown until separately approved first-party IPv6-capable infrastructure exists; the existing third-party browser check records only connectivity evidence and its provenance. Existing ISP, ASN, and organization labels, when present, remain marked legacy-unverified with their evidence method and unknown confidence/provenance; missing values stay unknown. The check does not perform a new external lookup or transfer for them. A minimal categorical verification history (timestamp, installation path and status, and failure category) has a 30-day retention policy and excludes current IPv4, raw WAN input, and DNS query history. After the updated authenticated maintenance route is deployed and invoked on its existing cadence, its history sweep handles at most 25 eligible household profiles or five seconds per run, after pause-recovery work. Repeated invocations remove expired or invalid-timestamp history entries; until the updated route is deployed and invoked, entries may remain longer than 30 days. No live purge was run for this update. Older network results do not satisfy the fresh verification requirement.

Automatic Dashboard filtering checks use a random, HTTP-only browser cookie and a browser/account-specific keyed connection digest. These checks retain only assigned resolver/profile references, check timestamps, bounded attempt identifiers and result categories, not raw IP addresses, ISP details, browsing history or cross-browser fingerprints. At most eight browser-check records are kept per household. Records inactive for 30 days are ignored and removed on the next browser-check write; this is not a scheduled deletion guarantee. The browser cookie expires after 30 days. These checks do not change your saved Home addresses or router setup completion.

Depending on your location, you may have the right to access, correct, or delete your personal data. To exercise these rights, email us at privacy@datante.com. We will respond within 30 days.

We use industry-standard security practices including encrypted connections (HTTPS/TLS), row-level security in our database, and separation of service keys. No system is perfectly secure, but we take reasonable measures to protect your data from unauthorized access, alteration, or disclosure.

To protect the service from bots, scraping, and abuse, our web servers keep a security request log of visits to our public (marketing) pages. Dashboard and account pages are not included, and visitors who have enabled “Disable activity recording” are excluded from this log except when a request is classified as automated (bot) traffic or comes from a network on our deny list. For each logged request we record:

• The timestamp of the request
• The requesting IP address
• The HTTP method and response status (e.g., GET, 200 or 403)
• The URL path requested (never query-string parameters)
• The browser user-agent string
• The referrer, reduced to its origin and path (never query strings or fragments); not recorded for blocked requests
• Network information — the network operator (ASN and organization name) and country associated with the IP address, when available
• For regular (non-bot) visitors, your anonymous session ID — the same random cookie identifier described in the analytics section, so automated traffic can be distinguished from real visits. Bot and deny-listed requests are never assigned a session ID.

Requests from networks on our abuse deny list are refused with an error and recorded in the same log regardless of which page was requested, so blocked traffic can be audited. For those blocked requests only the timestamp, IP address, method and status, path, and user-agent string are recorded.

This log never contains request bodies, cookies, session tokens, auth headers, or any other credentials.

Retention: entries are automatically deleted after 30 days.

Legal basis: we process this data under our legitimate interest in keeping the service secure and available (GDPR Art. 6(1)(f)). It is used only for security and abuse-prevention purposes — never for advertising, profiling, or tracking.

Access: the log is accessible only to Datante administrators and is never shared with third parties, except where required by law.

Datante collects a small set of product events to measure service reliability and understand how features are used. All events are fired server-side — they cannot be intercepted or blocked by browser extensions or DNS-level ad blockers.

Events we collect:

• visit.page_view — anonymous visit to a public page; contains the URL path (never query-string parameters).
• op.preset_changed — you changed your protection level (e.g., Essential → Standard); contains the from/to level names only.
• op.filtering_paused / op.filtering_resumed — you paused filtering (contains the duration) or filtering resumed.
• conversion.subscribe — your subscription became active.
• conversion.install — you downloaded the optional desktop extension ZIP. Fired server-side when you click the download link in your dashboard.
• op.network_check_completed, op.network_router_selected, and op.network_setup_checked — the approved setup funnel records only allowlisted categories and booleans, such as path, reachability status, WAN-comparison category, and verification outcome.

Proposed additional network-funnel events are not active. Any new network telemetry requires separate approval before it is sent.

Every event payload contains only your anonymous session ID, your account ID (for authenticated events), the event type, and the URL path. No query-string parameters are ever included.

What we NEVER collect in analytics events:

• Page content or DOM snapshots
• Browsing history or previously visited URLs
• URL query-string parameters
• DNS query history or blocked-domain lists
• Search queries (including queries typed in the /help search box)
• AI prompts or AI-generated responses
• Session tokens, auth tokens, API keys, or passwords
• IndexedDB contents or localStorage values
• Your household ID or resolver IP address
• Network addresses, the WAN value you enter, DNS queries, provider endpoint identifiers, or setup credentials in network-event properties

A note on the desktop extension: The optional Datante Remote browser extension has no analytics runtime of its own. It cannot see your browsing history, tabs, or page content. The only analytics event associated with the extension isextension_downloaded, which is fired server-side when you download the ZIP from your dashboard — not by the extension itself.

How to opt out: Go to Dashboard → Account → Privacy and enable “Disable activity recording.” When this option is on, no analytics events are sent — not even page views. Operator accounts (ISP support staff) are excluded from analytics automatically and do not need to opt out.

We do not share analytics data with third-party advertising networks. Events are processed by our own internal analytics platform.

We may update this policy as the service evolves. Material changes will be announced by email to active subscribers at least 14 days before they take effect. The “Last updated” date at the top of this page always reflects the current version.

Questions about this policy? Reach us at privacy@datante.com.