Privacy should be part of the architecture.

Only data needed to operate accounts, subscriptions, device/profile assignments, abuse prevention, filtering policies and customer-selected statistics.

The production service should avoid unnecessary long-term detailed DNS history. Aggregate statistics and optional short-term diagnostics are preferable to indefinite browsing records.

DNS configuration should use anonymous, revocable profile identifiers rather than customer email addresses or names.

The service is being designed as a paid privacy and filtering product, not as a system for selling customer browsing data to advertisers.