Privacy, Data Collection and Use Policy

This Privacy, Data Collection and Use Policy (collectively Data Policy) describes the policies and procedures of the Quad9 DNS Service operated by CleanerDNS, Inc. (a California non-profit corporation) and on the collection, use and disclosure of information and the services, data, infrastructure or applications we offer to users of our services (collectively “Quad9 DNS Services” or “Quad9”). This Data Policy does not apply to information third-parties may collect about individuals outside Quad9 DNS Services and Quad9’s control.

Please read this Data Policy carefully. Should you have any questions about this Data Policy or Quad9’s data collection, use and disclosure practices, please contact us as set forth below.

What Does This Data Policy Cover?

This Data Policy explains our practices for gathering and disseminating information we collect when you use the Quad9 DNS Services.

This Data Policy covers the treatment of any information or set of information that identifies or that is used by or on behalf of Quad9 to identify an individual system, which may, in certain contexts, include information such as Internet Protocol (IP) address, time stamp, domain to be resolved, domain resolution results, geolocation and other network protocol information we gather through the services.

This Data Policy also covers our treatment of any information that our business or research partners share with us or that we share with our business or research partners.

This Data Policy does not apply to the privacy practices of third-parties that we do not own or control, including but not limited to any third-party websites, services, applications, online resources to which the services may reference, link to, frame, resolve or otherwise reference (collectively “Third Party Services”) that you may access through the services. We take no responsibility for the content or privacy practices of those third-party services. We encourage you to carefully review the privacy policies of any third-party services you access.

This policy may be amended by Quad9, and the new version of the policy shall become effective upon its posting on the Internet at the address specified in this paragraph (https://www.quad9.net/policy/) unless otherwise provided in the new version of the policy.

What Information Do We Collect?

When you use Quad9 DNS Services, the information we gather aides us to personalize, improve and operate our infrastructure. As an open DNS resolver, there is no signup or requirement to disclose PII to us other than that which is provided by accessing the service. The only method by which Quad9 can identify end user requests is by the IP address of the client. IP addresses may represent individual persons or devices, or they may represent (via NAT or forwarding resolvers) large groups of end users.  Quad9 does not and cannot distinguish between single and multiple users behind a single IP address.

Many nations classify IP addresses as Personally-Identifiable Information (PII), and we take a conservative approach in treating IP addresses as PII in all jurisdictions in which our systems reside. Our normal course of data management does not have any IP address information or other PII logged to disk or transmitted out of the location in which the query was received. We may aggregate certain counters to larger network block levels for statistical collection purposes, but those counters do not maintain specific IP address data nor is the format or model of data stored capable of being reverse-engineered to ascertain what specific IP addresses made what queries.

There are exceptions to this storage model: In the event of events or observed behaviors which we deem malicious or anomalous, we may utilize more detailed logging to collect more specific IP address data in the process of normal network defense and mitigation. This collection and transmission off-site will be limited to IP addresses that we determine are involved in the event.

Logs

We do keep some generalized location information (at the city/metropolitan area level) so that we can conduct debugging and analyze abuse phenomena. We also use the collected information for the creation and sharing of telemetry (timestamp, geolocation, number of hits, first seen, last seen) for contributors, public publishing of general statistics of use of system (protections, threat types, counts, etc.)

We do not correlate or combine information from our logs with any personal information that you have provided Quad9 for other services, or with your specific IP address.

When you use Quad9 DNS Services, here is the full list of items that are included in our logs:

• Request domain name, e.g. example.net
• Record type of requested domain, e.g. A, AAAA, NS, MX, TXT, etc.
• Transport protocol on which the request arrived, i.e. TCP, UDP, and encryption status of the protocol
• Origin IP general geolocation information: i.e. geocode, region ID, city ID, and metro code
• Protocol version IP address – IPv4, or IPv6
• Response code sent, e.g. SUCCESS, SERVFAIL, NXDOMAIN, etc.
• Absolute arrival time
• Name of the Quad9-operated machine that processed this request
• Quad9 target IP to which this request was addressed (no relation to the user’s IP address)

We may keep the following data as summary information, including all the above EXCEPT for data about the DNS record requested:

• Currently-advertised BGP-summarized IP prefix/netmask of apparent client origin
• Autonomous system number (BGP ASN) of apparent client origin

All the above data may be kept in full or partial form in permanent archives.

What Information Do We Share?

Except as described in this Data Policy, Quad9 does not intentionally share, sell, or rent individual personal information associated with the requestor (i.e. source IP address or any other information that can positively identify the system using our infrastructure) with anyone without your permission.

Quad9 DNS Services generate and share high level anonymized aggregate statistics including threat metrics on threat type, geolocation, and if available, sector, as well as other vertical metrics including performance metrics on the Quad9 DNS Services (i.e. number of threats blocked, infrastructure uptime) when available with the Quad9 threat intelligence (TI) partners, academic researchers, or the public.

Quad9 DNS Services share anonymized data on specific domains queried (records such as domain, timestamp, geolocation, number of hits, first seen, last seen) with its threat intelligence partners. Quad9 DNS Services also builds, stores, and may share certain DNS data streams which store high level information about domain resolved, query types, result codes, and timestamp. These streams do not contain IP address information of requestor and cannot be correlated to IP address or other PII.

Cookies and Other Technologies

Quad9’s website may use “cookies” and other technologies such as web beacons and pixel tags. These technologies tell us which parts of our websites people have visited, help us better understand user behavior, and facilitate and measure the effectiveness of advertisements and web searches. We treat information collected by cookies and other technologies as non‑personal information. However, to the extent that IP addresses or similar identifiers stored in log files generated by visiting our website are considered personal information by local law, we also treat these identifiers as personal information.

Compliance

It may be required by law, litigation, legal process, and/or legally binding requests from public and governmental authorities within or outside your country of residence for Quad9 to disclose your personal information.

Email

If you contact Quad9 on one of our email addresses, we may communicate with you using that address for the purposes of your original contact. We will not sell or share your email with third parties, except where necessary to operate the service, such as outsourced support or user forum applications. In those cases, we will hold all vendors to the same requirement of not selling or redistributing your email address or personal data.

Do Not Track

Quad9 does not track visitors over time and across third-party websites, and therefore does not respond to Do Not Track signaling.

Protection of Personal Information

Quad9 believes that privacy and control of your personal information is critical to your trust and therefore to the success of the system. Quad9 does not store PII IP address data on permanent storage methods (disk) or transmit that data out of the datacenter in which the query was received. All logging and inter-datacenter traffic is encrypted. Quad9 makes available encryption between clients and the Quad9 system to further protect against data interception or modification.

Contact us via our support form.

 

Updated February 7, 2018