diff --git a/website/PLAN.md b/website/PLAN.md
new file mode 100644
index 0000000..4117e38
--- /dev/null
+++ b/website/PLAN.md
@@ -0,0 +1,51 @@
+# nxdns.sh — marketing and docs website plan
+
+Agreed in an interview on 2026-08-15. This directory will hold the site's source.
+
+## Purpose
+
+Convince, then teach. A marketing front page sells the project; the docs sit one click away. mediabunny.dev is the structural model (landing on top, docs behind it), not the visual one.
+
+## Domain and hosting
+
+- Domain: `nxdns.sh` (already owned).
+- Host: Cloudflare Pages.
+- Deploy: Gitea Actions builds the site on push to master, then `wrangler` uploads the output. A Cloudflare API token lives as a Gitea secret. (Cloudflare Pages has no Gitea integration, so direct upload is the mechanism.)
+
+## Stack and layout
+
+- Astro + Starlight, in this `website/` directory.
+- Starlight reads the existing `docs/` Diátaxis tree in place. Docs and code version together; nothing moves or syncs.
+
+## Landing page
+
+Three sections:
+
+1. Hero: one-line pitch and a copyable install command. Releases 0.0.1–0.0.3 exist, so the command is real.
+2. Feature grid: filtering, config-as-code, DoH/DoT, per-client groups, metrics, query log.
+3. Comparison table vs Pi-hole, AdGuard Home, Technitium — short, only to help people choose.
+
+The pitch leads with what nxdns does, not with attacks on the incumbents. No screenshots.
+
+## Docs section
+
+- The full `docs/` tree (tutorial, how-to, reference, explanation) plus a changelog page rendered from `CHANGELOG.md`.
+- `PLAN.md` (root) and `specs/` stay repo-only.
+- Pagefind search (Starlight built-in) is on. No analytics. No live demo instance.
+
+## Look
+
+- Clean technical. Light default with a dark toggle.
+- Orange/amber accent.
+- Brand is the lowercase `nxdns` wordmark in a distinctive typeface. No drawn logo.
+- Copy tone: personal / indie, first person — why I built it and what it fixes — in the honest voice the docs already use.
+
+## Links
+
+Source links point to `git.mial.net/mokhtar/nxdns` only. No GitHub mirror.
+
+## Open questions
+
+1. Wordmark typeface — resolve in the design pass.
+2. Does the Gitea container registry allow anonymous pulls? That decides whether the hero shows `docker run` or the binary install from INSTALL.md.
+3. Fact-check the comparison table against current competitor versions before publication.