Last updated 26 October 2026. This policy describes how the site is built to work. If you run your own copy, review it against your own hosting and analytics before publishing it.
The short version
- We do not write visitor IP addresses to logs or a database.
- We do not set advertising or tracking cookies, and the tools do not need an account.
- Your IP is used only to answer your request, then it is discarded.
- A few third parties necessarily see your IP when the tools run. They are listed below.
What happens to your IP address
When you use a tool, our server reads your IP address from the connection so it can answer. It is held in memory for the duration of the request. We keep it longer only in these cases:
- Abuse counters. To stop automated abuse, we count requests per network for a short window (minutes to hours, up to 24 hours for the free API). Counters live in server memory or, if configured, in a shared Redis service, keyed by the address, and expire automatically.
- Geolocation cache. Lookup results are cached in memory for about an hour.
- DNS leak test. We store the addresses of the DNS resolvers that asked our DNS server, against a random test code, for ten minutes. Resolvers are servers, not you, although a resolver can be on your home network.
Third parties that see your IP
| Who | Why |
|---|---|
| IP geolocation providers (ipwho.is, ipapi.co) | We send the IP being looked up so they return location and network information. Their own policies apply. |
| ipify (api4.ipify.org, api6.ipify.org) | Your browser calls them directly to learn its IPv4 and IPv6 address, so they see your IP. We use them because our host cannot offer single-stack addresses. Their own policy applies. |
| Internet registries (IANA, regional RDAP servers, rdap.org) | When you use the IP lookup, we send the IP or domain you typed to the registry that holds its record. They see our server's address, not yours. |
| DNS resolvers (1.1.1.1, 8.8.8.8) | For reverse DNS, DNS lookup and domain lookups, we send the address or domain you typed. They see our server, not you. |
| Websites you check | The website safety checker connects from our server to the site you enter. The site sees our server's address and not yours. We refuse private and internal addresses and do not store the results. |
| Our DNS test server | The DNS leak test contacts a small server we run (on a different host name than this site). It sees your IP like any web server and keeps only the resolver addresses described above. |
| STUN server (Google by default) | Your browser contacts it directly during the WebRTC test. It sees the address your browser connects from. |
| Our hosting and network providers | They carry the traffic and may keep their own connection records, for example a CDN or proxy in front of the site. |
| VPN partners | Only if you click an affiliate link. Their policy applies from then on. |
Affiliate clicks
When you click a partner link we record a counter event with the link's name, which page placement it came from and the time. It does not include your IP address or any identifier. The partner may place its own cookie after you arrive on its site.
Cookies and storage
This site does not set cookies. The fingerprint and score tools compute results in your browser and show them to you; they are not saved or uploaded.
Port scans
The port checker connects to common ports on the public IP your request came from, only when you press the button. The result is returned to you and not stored.
Your rights
Because we do not keep personal data about you, there is usually nothing to access or delete. If you believe we hold something about you, or you have a question under GDPR, India's Digital Personal Data Protection Act or similar laws, email contact@scanmyprivacy.com.
Email sign-up and API key requests
If you choose to subscribe, you tick an unticked consent box and enter your email address. We send that address (and the topic you chose and the page you were on) to the email service we use, which sends a confirmation message before you are added. We do not log your address on our servers, do not send your scan or checkup results, and do not use tracking pixels or sell addresses. You can unsubscribe from any message. API key requests send your email, use case, expected volume and notes to the same kind of service so we can reply. Contact contact@scanmyprivacy.com to have your address deleted.
Affiliate links
Links that go through /go/ redirect to a partner. When you click one, we record only which tool was clicked and which placement it was on, with no IP address or other identifier. The partner may set its own cookies once you reach its site. See how we choose recommendations.
Anonymous product events
To learn which tools people finish and which suggested fixes are useful, the site records a small set of anonymous events: a tool was completed (success or error), a coarse result category such as "exposed" or "clear", a click on a suggested next step, a click on an API key request, and a click on a guide. Each event contains only a tool name and a category word from a fixed list. It contains no IP address, user agent, referrer, cookie, or anything you typed. Nothing is sent if your browser sends Global Privacy Control or Do Not Track.
Result categories are also added to monthly totals, one counter per tool and outcome (for example, how many WebRTC tests in a month found a leak). A counter holds a number only: there is no record of who ran a test or when within the month. We publish these totals, once there are enough tests behind them, on the statistics page.
Safety tools run in your browser
The suspicious link checker, scam and phishing detector, mobile app safety guide, browser security guide and security checkup analyse what you enter in your browser. The text, address or answers are not sent to our servers and are not stored.
Changes
If our practices change, we will update this page and the date above.