Privacy Policy

Your account. Your email address, and a display name if you gave one. If you signed up with a password we store a bcrypt hash of it, never the password. If you signed in with Google we store no password at all — only the verified email address Google gave us.

Your API keys. Stored as a SHA-256 hash plus a short visible prefix so you can tell your keys apart. The key itself is shown once, at creation, and cannot be recovered from us afterwards.

Your usage. A count, per day, of how many lookups you made, how many were served from cache, and how many failed. We do not record which addresses you look up. Nothing in our systems ties a queried address back to the account that queried it.

Your session. A cookie holding a random token. We store only its hash, and it expires after 30 days.

Your billing. Stripe handles payment. We store the identifiers Stripe gives us for your customer and subscription records, your plan and its status. We never see or store card numbers.

Answers we fetch about an IP address are cached and reused, keyed by that address. This is what makes the service affordable, and it is the reason a lookup you make may be answered without any call to an upstream provider.

The cache holds an address, its approximate location and network, and privacy signals such as whether it belongs to a datacentre. It holds no account identifiers: a cached row does not record who asked for it.

Location data expires after 30 days and privacy data after 24 hours, after which expired rows are deleted.

ipinfo.io resolves the addresses you look up. The address is sent to them; your identity is not.

Stripe processes payments and holds your card details under its own privacy policy.

Google sees only that you chose to sign in with it, and returns your email address and name to us. We request no other access — not your Gmail, your files, or your contacts.

Render hosts the service and its database in Singapore.

We do not sell your data, and we do not share it for advertising.

Your account and its usage history stay until you ask us to delete them. Usage counts outlive a cancelled subscription because they are the record of what you were billed for.

Revoked API keys are kept as revoked rather than deleted, so a key cannot be silently resurrected.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. Write to iyoulord1@gmail.com and we will act within 30 days.

Deleting your account removes your email, name, keys and usage history. It does not empty the lookup cache, because no part of that cache is attached to you.

If this policy changes in a way that affects what we collect or who we share it with, we will email account holders before the change takes effect.