A small utility for checking whether a username or domain name is available has quietly drawn attention for what it refuses to do: track you. NameSweep, an iPhone app built by developer Luke Mulholland that scans domains, social platforms and code repositories for name availability, has published a privacy policy that reads less like a legal shield and more like an architectural choice. The data generated by a search stays on the device that generated it.
That distinction matters more than it might first appear. Most apps that query external services - whether checking a username on Instagram or a package name on npm - tend to route that activity through their own servers, where it can be logged, aggregated or monetized. NameSweep's design instead has the phone talk directly to each service: Cloudflare's DNS infrastructure, the RDAP registry system, GitHub, GitLab, npm, PyPI, Reddit, Discord and Apple's own App Store search, among others. The company in the middle never sees the query. It's a structural decision that echoes a broader principle in digital privacy: the fewer intermediaries that handle your data, the fewer places it can leak, be subpoenaed, or be resold. For users who also rely on tools like virtual private networks to control what their internet traffic reveals, this app-level discipline is a useful reminder that not all privacy protections come from a single tool - and, as with VPN subscriptions, why the cheapest option is rarely the best when the real cost is measured in data practices rather than price tags.
What actually crosses the network
When someone runs a check, the name itself - plus the usual technical baggage of any web request, such as an IP address - travels to whichever service is being queried. Social platforms including Instagram, TikTok, X, Facebook, Pinterest, YouTube and Google Play are checked through a private in-app browser that discards cookies between sessions, which limits the ability of those platforms to link one search to the next. Each destination service still operates under its own privacy policy, so the protection NameSweep offers is about minimizing exposure, not eliminating it. Domain pricing data, drawn from Porkbun's public pricing API, is the one request that carries no name and no identifying information at all.
Accounts, purchases and the optional GitHub token
NameSweep doesn't require an account, and most functionality works without one. Signing in - through Apple, Google or email - creates a record with Supabase, the app's authentication provider, consisting of an email address and account ID. Apple's private relay option lets users hide their real address entirely. Purchases, meanwhile, run through Apple's StoreKit, meaning the developer never handles payment information directly. Users who add a GitHub token to raise API rate limits will find it stored in the iPhone's Keychain, a secure enclave designed for exactly this kind of credential, and sent only to GitHub itself.
No ads, no analytics, no cross-app tracking
The policy's most notable claims are about absence: no advertising identifiers, no analytics frameworks, no tracking across other apps or websites, and no sale of personal information. In an advertising economy where even simple utilities often embed multiple third-party trackers, that omission is itself a design statement. It also simplifies compliance with regional data protection rules, since there's little personal data to govern in the first place - the email address tied to an optional account is effectively the only piece of information a user might ever need to delete.