IP-FD.net
Sign in

Privacy policy

Last updated 2026-10-11.

Who we are

This policy explains what personal data IP-FD.net ("we") collects when you use the website and the API, why we collect it and what your rights are. Questions can be sent through the contact page.

Data we collect

  • Account data: username, email address and a bcrypt hash of your password. If you sign in with GitHub or Discord we receive your account ID, username and avatar from that service.
  • Security data: the IP address and browser user agent of each session and sign-in attempt, used to show your active sessions and to detect abuse.
  • API usage: for requests made with your API key we store the endpoint, the address you looked up, its country and the time, and a daily count per key. This powers your usage statistics and daily quota.
  • Request logs: every API request is logged with its endpoint, time and source IP address for rate limiting and abuse prevention.
  • Things you set up in your account: saved addresses and networks, allow and block lists, check settings, custom endpoints, watched addresses, projects and their members, BGP and blocklist watches, and alert channels (email addresses and webhook URLs you enter).
  • Decision log: when you use the check endpoints with your key, the address checked, the answer and the reasons are kept for a few days so you can see why an address was allowed or blocked.
  • Support data: messages and attachments you send through tickets, the contact form, email to our support addresses, location reports and geofeed submissions.
  • Monitors: the targets, settings and check history of uptime monitors you create. Passwords for monitored URLs are stored encrypted.

We do not build profiles of visitors. Pages you only read are not linked to you, and the short-lived counters that protect the site against floods are held in memory and not stored.

Cookies

Visitors who only read pages or call the API get no cookie at all. We set a session cookie when you sign in, a cookie that protects forms against cross-site request forgery on sign-in pages and while you are signed in, a short-lived cookie during two-factor or GitHub and Discord sign in, and, if the site asks your browser to pass an automated check, a cookie that remembers it passed. These are necessary for the site to work.

Web analytics (Google Analytics, with IP anonymisation) is loaded only after you agree to it, and sets its own cookies then. If you choose required only, nothing is loaded. You can change your choice at any time with the button in the corner of the page. Your choice and your theme are stored in your browser's local storage, not in a cookie.

Why we use it

  • To provide the lookups, API, monitors and account features you use (performance of the service you asked for).
  • To keep accounts secure and stop abuse of the service (our legitimate interest in running a safe service).
  • To answer support requests and review location reports.
  • To send emails you need, such as password resets, email confirmation, alerts you switched on and ticket replies.
  • Web analytics, only with your consent.

Third parties

We do not sell personal data. Some features rely on outside services:

  • RIPE NCC: addresses looked up on the website may be sent to RIPE IPmap, RIPEstat, the RIPE Database and RIPE Atlas to find their network and location. Your own IP address is not sent with them.
  • AbuseIPDB: the address on an IP page, or in an API call made with a key, may be checked against its abuse reports. Only the address being looked up is sent.
  • Spamhaus and other blocklists: asked through DNS when you use the blocklist check or a blocklist watch.
  • OpenStreetMap: map tiles on lookup pages are loaded by your browser from its servers, which therefore see your IP address.
  • Google Analytics: only after you agree to analytics.
  • GitHub and Discord: only if you choose to sign in with them.
  • Discord: our team is notified of new support tickets in a private Discord channel. The notice contains the subject and the start of the message.
  • Our email provider: for messages we send to you and for email you send to our support addresses.

Fonts, flags, the map library and the check of your own IPv4 and IPv6 address are served by IP-FD.net itself, not by other companies.

How long we keep it

  • Account data and the things you set up in your account: until you remove them or delete your account.
  • API request logs: 14 days. API usage per key: 180 days.
  • Decision log: 7 days.
  • Sign-in history: 180 days.
  • Sessions: 30 days after you last signed in.
  • Monitor check history: 30 days.
  • Support messages: until the ticket is deleted or your account is removed.

Your rights

You can see and change your account details, export your data and delete your account at any time from the dashboard (Account page). Deleting your account removes your API keys, usage history, saved items, lists, custom endpoints, watched addresses, projects, monitors and tickets at once. If you have no account, or cannot sign in, send a deletion or access request through the contact page and we answer within 30 days. For any other request about your data, including correction or objection, contact us. If you are in the EU or UK you can also complain to your data protection authority.

Registry data

IP-FD.net shows data published by the regional internet registries. Organisation names, abuse contacts and addresses come from their public databases. If you want registry data about you changed, contact the registry or your network provider. We update our copy every day.

Changes

When we change this policy we update the date at the top. Important changes are announced on the site or by email.