Privacy Policy

This Privacy Policy explains how MaxPoints LLC, doing business as MaxPoints (“MaxPoints,” “we,” “us,” or “our”), collects, uses, discloses, and protects information when you use MaxDomains. It applies to the MaxDomains website, domain search and price comparison experience, registration ordering, account features, and related services (collectively, the “Services”).

By using the Services, you acknowledge the practices described in this policy. Your use of MaxDomains is also governed by our Terms of Service.

Information you provide

When you start MaxAuth account sign-in, you provide an email address. Sign-in and any password or email-verification step are handled by MaxAuth, MaxPoints' shared identity service. After sign-in, MaxDomains receives the account identifier, email address, email-verification and assurance status, and limited membership details such as plan, status, and expiration information needed to provide account features.

If you submit a domain registration, we collect the registrant name, organization (if provided), street address, city, state or province, postal code, country, and phone number. MaxDomains does not directly collect payment-card information in this flow.

Domain searches and registrations

The domain text you search is sent to the MaxDomains server and to OpenSRS to retrieve current availability, registration prices, and renewal prices. If you place an order, your selected domain, registrant contact details, and MaxAuth account email are sent to OpenSRS to process the registration.

MaxDomains stores your MaxAuth account identifier with the domain, OpenSRS order identifier, order price and currency, registration and renewal state, expiration date, and any MaxChef project ID you connect. We use this information to restore and maintain your domains when you return or sign in on another device.

If you allow optional analytics, we record the length of a valid search query, but not the search text. We may also record the extension, whether an order was pending when submitted, and when a domain is connected to MaxVolts, but not the full domain name, MaxChef project ID, or registrant contact details.

If you connect MaxChef, we store its time-limited access token in an encrypted HttpOnly cookie. MaxDomains uses that token only to list projects you authorize and ask Chef to stage a selected domain in MaxVolts. When you connect a domain, the domain and DNS records are processed through Chef, MaxVolts, and OpenSRS. The token is not exposed to browser JavaScript and is revoked when you disconnect MaxChef or sign out of MaxDomains.

Information collected automatically

When you use the Services, we may collect:

• Operational page data: the page path and title, time of the request, and a randomly generated first-party visitor identifier. This supports basic service measurement even if you decline optional analytics.
• Optional analytics: if you consent, page and feature interactions, a first-party visitor identifier, and attribution information such as referring site, landing page, and UTM campaign, source, medium, content, or term parameters.
• Technical and request data: information normally sent when a browser connects to a service, such as IP address, browser or device information, requested page, request time, and response status.
• Error diagnostics: error type and message, software and component stack information, and the page path where an error occurred. Our error-reporting tools are designed to remove URL queries and fragments and redact common contact, payment, credential, and account data before a report is sent.

MaxDomains does not load advertising pixels or third-party analytics trackers.

Cookies and browser storage

MaxDomains uses first-party browser storage to remember your analytics choice, an operational visitor identifier, and an analytics session entry (a local storage key ending in :session that holds a random session ID and the time of your last activity, used to group page views and events into one visit). If you allow optional analytics, browser storage may also retain first-touch referral and campaign attribution. These items remain until you clear the site's browser data. Declining optional analytics removes optional attribution data.

If you submit a domain order while signed out, we temporarily save the entered contact details, selected domain, quoted price, and registration consent in that tab's session storage so the order can resume after sign-in. We remove the saved draft when you return; drafts older than 30 minutes are not resumed. Closing the tab also clears this session storage. Authentication tokens are not stored with the draft.

Sign-in uses encrypted, HttpOnly, same-site cookies that are not readable by browser JavaScript. A temporary transaction cookie protects the sign-in exchange and expires after about 10 minutes. If you sign in, a MaxDomains session cookie holds the limited account and membership information described above and expires after up to eight hours. Signing out clears that session cookie.

How we use information

We use information to:

• provide, operate, maintain, and improve the Services;
• authenticate users, maintain sessions, and provide eligible account and membership features;
• understand service use, measure feature usefulness, and improve the experience;
• detect, investigate, prevent, and respond to errors, fraud, misuse, and security incidents;
• respond to correspondence and privacy requests; and
• comply with law, protect rights and safety, and enforce our agreements.

How we disclose information

We may disclose information:

• within MaxPoints, including to MaxAuth and the MaxPoints systems that provide analytics and error reporting for MaxDomains;
• to hosting, infrastructure, security, support, and other service providers that process information for us under appropriate restrictions;
• to OpenSRS and applicable domain registries when you search for or order a domain;
• when reasonably necessary to comply with law or legal process, enforce agreements, or protect the rights, property, or safety of MaxPoints, our users, or others;
• in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business or assets; or
• at your direction or with your consent.

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

Retention

MaxDomains does not intentionally retain search text outside the request and ordinary operational logs. OpenSRS and applicable registries may retain search, contact, and order records under their policies and legal obligations. Authentication cookies use the short expiration periods described in this policy. Browser-stored consent, operational, and optional analytics information remains until you change your choice or clear the site's data, as applicable.

We retain account, analytics, diagnostic, request, and correspondence information only for as long as reasonably needed for the purposes described in this policy, including to provide and secure the Services, meet legal obligations, resolve disputes, and enforce agreements. Retention periods vary based on the type of information and those needs, after which information is deleted or de-identified where reasonably practicable.

Your choices and privacy rights

You can allow or decline optional analytics when the MaxDomains consent notice appears. Declining stops optional feature events and attribution collection, but does not disable operational page measurement, security, or error reporting. To change a saved choice, clear the site's browser storage and choose again when the notice reappears. Clearing first-party cookies and site storage may also sign you out.

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information, or to object to or restrict certain processing. You may also withdraw consent for future optional analytics through the consent notice. To make a request, contact us using the mailing address below. We may need to verify your identity and may retain information when permitted or required by law.

Legal bases for processing

Where applicable law requires a legal basis, we process information as needed to provide the Services and perform our agreement with you, with your consent, to comply with legal obligations, and for our legitimate interests in operating, measuring, securing, and improving the Services, provided those interests are not overridden by your rights.

Data security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted and HttpOnly authentication cookies, short session lifetimes, same-origin request protections, and redaction of common sensitive data from error reports. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International data transfers

MaxPoints is based in the United States. If you access the Services from another country, your information may be processed in the United States or another country where we or our service providers operate. Where required, we use safeguards intended to protect information transferred across borders.

Children's privacy

The Services are intended for people age 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the Services, please contact us so we can take appropriate action.

Changes to this policy

We may update this policy as the Services or legal requirements change. We will post the updated policy and revise the “Last updated” date above. If a change is material, we may provide additional notice where required by law.

Contact us

Questions, concerns, or requests about this policy or our privacy practices may be mailed to: