Last updated: April 18, 2026
The ipinfo.app suite is a personal project operated by Cameron Munroe. We build free IP-address utilities — ASN lookups, geolocation, reputation scoring, blocklist generators — and this policy describes how the services handle the data they see while serving your requests.
The short version: no accounts, no cookies for tracking, no advertising, no data sales. An IP-address tool inherently has to see your IP address, but we keep standard web server logs and short-lived result caches — nothing beyond that.
1. Services Covered
This policy applies to the following services:
- ipinfo.app — Landing page and service index
- my.ipinfo.app — "What is my IP?" lookup
- asn.ipinfo.app — ASN, prefix, and IP details lookup
- asn-legacy.ipinfo.app — Legacy PHP ASN service (kept during transition)
- blackbox.ipinfo.app — IP reputation and proxy/VPN classification
- ip2asn.ipinfo.app — IP-to-ASN mapping
- atlas.ipinfo.app / ip2country.ipinfo.app — IP geolocation
- sfs.ipinfo.app — Stop Forum Spam blocklist generator
2. What We Collect
Request data (all services)
When you send a request to any service in the suite, the following is logged to standard web server / application logs:
- Your IP address — required to deliver a response, and for several services it is also the subject of the lookup
- User-Agent string and, where present,
Accept-Language - Requested path and query string (for example, the IP or ASN you looked up)
- Referrer, if your browser sends one
- Timestamp of the request
These logs exist for operations, debugging, and abuse mitigation. They are not used for advertising and are not sold or shared.
Lookup inputs you submit
IPs, ASNs, and organisation names you type into search fields are processed to produce a result. Results are cached server-side (see §5). Inputs themselves are not persisted beyond standard request logs and the result cache keys they produce.
Analytics (my.ipinfo.app only)
my.ipinfo.app loads Cloudflare Web Analytics and Real User Measurements (RUM) at the edge. These collect anonymous, aggregate performance and traffic data. They do not use cookies, do not fingerprint individual visitors, and are not used to build profiles. See Cloudflare's privacy policy for details.
What we don't collect
- No account system — there is nothing to sign up for
- No tracking cookies, no ad pixels, no session fingerprinting
- No cross-site advertising identifiers
- No sale of data to third parties — ever
3. How We Use the Data
- Serve your request — performing the lookup you asked for
- Cache results — so repeat lookups are fast and external APIs are not hit unnecessarily
- Rate-limit abuse — identify and throttle IPs issuing unreasonable request volumes
- Debug and operate the service — diagnose failures, correlate errors with deployments, monitor capacity
- Improve the underlying data — e.g. refining the Blackbox proxy/VPN model from aggregate signal patterns (not individual users)
4. Third Parties
Infrastructure
- Cloudflare — CDN, DDoS protection, TLS termination, and (on my.ipinfo.app only) Web Analytics. Your request necessarily passes through Cloudflare's edge.
- Self-hosted Kubernetes — request handling and application logs live on infrastructure operated directly by us, not on a shared multi-tenant cloud.
Upstream data sources
The suite enriches lookups using third-party datasets. Most are bulk downloads (no per-request call), but a few services contact upstreams in real time:
- RIR RDAP (ARIN, RIPE, APNIC, LACNIC, AFRINIC) — queried on-demand for WHOIS / ASN registration data; responses are cached
- DNSBL zones, AlienVault OTX, StopForumSpam, Shodan InternetDB — queried by my.ipinfo.app reputation widget; results are cached
- MaxMind GeoIP2, iptoasn.com, PeeringDB, Spamhaus ASN-DROP, Tor directory — bulk downloaded on a schedule; no per-request traffic
- OpenStreetMap — if you open the interactive map on my.ipinfo.app, coordinates are sent directly from your browser to OSM tile servers — they are never routed through our servers
Third-party API marketplaces
Some Blackbox endpoints are offered via RapidAPI. If you access Blackbox through a RapidAPI subscription, your request is subject to RapidAPI's privacy policy in addition to this one.
5. Data Retention
- Web server / application logs — retained for a short rolling window (typically ≤ 14 days) for operations and abuse investigation, then rotated out
- Result caches — reputation and ASN data: up to 72 hours; WHOIS and ASN registration data: up to 7 days; per-IP lookups generally: 1 week at the Cloudflare edge
- Aggregated analytics (Cloudflare Web Analytics) — retention governed by Cloudflare's policy
We do not build long-term per-visitor profiles, and we do not retain request logs beyond what is needed to keep the services running.
6. Per-Service Notes
Most of the suite behaves identically with respect to data. These are the service-specific carve-outs:
Renders your IP, ASN, geo, and reputation data. Loads Cloudflare Web Analytics and RUM at the edge. Browser fingerprinting data shown on the page (WebGL renderer, plugin list, etc.) is collected and displayed client-side only — it is not sent to our servers. Clicking "map" sends your approximate coordinates directly to OpenStreetMap.
Looks up ASNs, prefixes, and IP details. Search endpoints have a soft rate limit (≈30 req/min per IP) enforced against request-log IPs. No lookup history is tied to your IP beyond the log-retention window.
Returns reputation signals for an input IP. Both the querying IP and the queried IP are visible in request logs. Aggregate signal patterns inform the classification model; we do not link activity back to individual users.
Maps an IP to its ASN. The /lookup/@me shortcut uses your current IP.
Data is served from a local database refreshed weekly from iptoasn.com
— no upstream call is made per request.
Geolocation lookups backed by MaxMind GeoIP2 and PeeringDB data refreshed on a schedule. No third-party call is made per request.
Generates blocklists from the public StopForumSpam dataset. The service does not send your IP or identity to StopForumSpam — only bulk dataset downloads happen on a schedule.
7. Cookies
The ipinfo.app services do not set cookies for tracking, advertising, or session purposes.
Cloudflare may set its own security cookie (__cf_bm) for bot management; this
cookie is scoped to bot protection and is not used for advertising or cross-site tracking.
8. Your Rights
Depending on where you live, applicable law may give you rights over personal data we hold about you — including the right to access, correct, delete, or restrict processing. If you are a California resident, you additionally have the rights granted by the California Privacy Rights Act (CPRA):
- Right to know — what personal data we have collected about you
- Right to delete — request deletion of personal data we hold
- Right to correct — request correction of inaccurate data
- Right to opt out — we do not sell or share personal data for cross-context behavioural advertising, and never will
- Right to non-discrimination — we will not penalise you for exercising any of these rights
Because the services do not maintain accounts, in most cases we do not hold any data that is meaningfully "about you" beyond short-lived IP-keyed request logs. If you believe we hold data about you that you want removed, contact us (see §11) and we will respond within 45 days.
9. Children's Privacy
The services are not directed at children under 13 and are not designed to collect personal information from them. If you believe a child has submitted information to us, please contact us and we will delete it.
10. Changes to This Policy
This policy may be updated from time to time — for example, when a new service is added to the suite or an upstream data provider changes. Material changes are reflected in the "Last updated" date at the top of this page. Continued use of the services after a change is posted constitutes acceptance of the updated policy.
11. Contact
Questions about this policy, or a request to exercise any of the rights in §8? Email — please include "ipinfo.app privacy" in the subject line so the request is routed correctly.