Domain offers and contact details
When you submit a domain offer, we store your name, email, offer amount, optional contact details, and message to discuss the domain transaction. Full contact details are stored encrypted and are available only to authorized administrators. Email verification codes expire and are stored only as keyed digests; submitting an offer does not subscribe you to notifications.
Offers, names, email addresses, and other contact details are not published. Verification status and offer history are available only to authorized administrators. The owner receives an offer summary by email. Their private Feishu notification card includes your submitted name, email, other contact details, and message so they can contact you directly. Keyed rate-limit identifiers help prevent abuse without storing raw IP addresses.
To withdraw your acquisition inquiry or request deletion of contact details, reply in your email conversation with the domain owner. The owner will verify mailbox ownership before handling your request.
What this site stores
Your timer names, chosen providers, reset times, and theme preference are stored in this browser’s local storage. These values are not sent to our reset-data endpoint. Optional background alerts use your WhenReset account and the email address, browser push endpoint, Telegram chat, or group robot you explicitly connect. This does not connect to your AI provider accounts.
Signing in
A WhenReset account is an email address you confirm with a one-time sign-in code. We store that address encrypted, plus an unreadable hash used to find it again. There is no password. A sign-in code is valid for 10 minutes, allows a limited number of attempts, and is never stored in readable form.
Signing in sets one first-party session cookie, __Host-wr_session. It is host-only: your browser sends it to whenreset.ai alone, never to any subdomain. The sign-in code expires after 10 minutes; the session it opens lasts up to 90 days, and signing out ends it immediately. To limit abuse we count sign-in requests against an irreversible keyed hash of the requesting network address: the address itself is not stored, and the account record holds nothing that identifies your device.
Public data, hosting & analytics
Our server requests public reset and service-status information from third-party sources. The hosting provider may process normal request information such as IP addresses and request logs to deliver and protect the website. When enabled, Cloudflare Web Analytics measures page views, referring websites, browser and device information, country, and page performance on our public website. It does not use analytics cookies or identify you across websites. We do not send your timer names, reset times, email address, or sign-in codes as analytics events. The administration site is excluded. There are no advertising trackers.
To exclude this browser from analytics, open whenreset.ai/?analytics=off. This saves an opt-out preference in local storage; if storage is unavailable, the opt-out applies only to that page load. Reload any other open WhenReset tabs for the preference to take effect there. Open whenreset.ai/?analytics=on to enable measurement again.
Notifications and calendar files
Browser notifications require permission you grant in your browser. Tab alerts require an open page. Optional background push uses a Service Worker and can work after the tab closes, subject to browser, operating system, network and notification settings. Calendar files contain the name and time you entered; once imported, your calendar provider’s settings and privacy policy apply.
Optional background alerts
Subscription destinations and group signing secrets are encrypted in server storage. We keep your selected providers, announcement types, verification and consent times, and delivery attempt status to manage the subscription. Destination confirmation codes expire after 15 minutes. We send notification content and the necessary destination to the channel you select; its privacy policy applies. Provider acceptance does not prove receipt or reading.
Disconnect a destination from Alerts or use the unsubscribe link in its notifications. Disconnecting removes its stored destination and signing secret and cancels queued messages. Operational records remain for troubleshooting. Messages already accepted by a channel may still arrive. Group robot setup requires permission from that group.
Control your data
Remove individual entries in My timers, or clear this site’s storage in your browser settings to remove all local preferences and timers. You can revoke notification permission in browser settings. To stop a server subscription as well, disconnect it on the Alerts page; clearing browser storage alone does not unsubscribe it. Clearing site data does not delete calendar events you already imported.
External links
Official documentation, social posts, and independent archives open on their own services. Their privacy policies apply there. Review the URL before signing into any provider.