1. Who we are

GoIPScan (goipscan.com) is run by Anand Muddi, an independent developer based in the United Kingdom. Anand is the data controller for this site.

You can reach us about anything in this policy at [email protected], or through our contact page.

2. What we process

Your IP address. Every website sees this. We use it to produce your lookup result, and our hosting and CDN providers see it as part of delivering the page.

Approximate location data. Cloudflare passes our servers a city, region, country, postcode area, timezone and coordinates derived from your IP. This is an estimate tied to network infrastructure, not your device's GPS, and it is often wrong by some distance — we measured that ourselves.

Anything you type into a tool. If you enter an IP address, hostname, domain or email header, we send it to the relevant provider to answer your query. Don't paste anything confidential into these tools.

Standard technical data. Browser type, device characteristics and referring page, as sent by your browser.

We do not ask for your name, address or payment details, and there is no account to create.

3. Who processes it

We are a small site built on other people's infrastructure. These are the companies involved and what each one does:

• Cloudflare — CDN, security and DNS in front of the site. Cloudflare also supplies the approximate location headers our IP lookup uses, runs Cloudflare Web Analytics (which is cookieless and does not fingerprint you), answers reverse-DNS queries over DNS-over-HTTPS, and hosts the speed-test endpoints.
• Netlify — hosting and the edge functions that run our lookups. Netlify keeps its own short-lived access logs.
• IPinfo — supplies network and organisation data for IP lookups.
• ipapi.is — supplies the VPN, proxy, Tor and hosting indicators used by the IP reputation tool.
• Google AdSense — serves the ads that fund the site, and shows the consent message described in section 8.
• OpenStreetMap — map tiles on the homepage, loaded by your browser.
• Internet registries — the WHOIS tool looks up the authoritative registry for your query in IANA’s bootstrap registries (data.iana.org) and queries that registry directly, so the query is seen by whichever body holds the record — for example Verisign for .com, Nominet for .uk, or RIPE and ARIN for IP ranges and AS numbers. rdap.org is used only as a fallback when the authoritative server cannot be resolved or does not respond.
• Google and Cloudflare STUN servers — used by the WebRTC leak test to discover how your connection appears from outside.

Each of these has its own privacy policy governing what it does with the data it receives.

4. Why we process it

To return the result you asked for; to keep the site available and defend it against abuse; to understand roughly how many people use which pages; and to show advertising that pays for the site.

5. Our lawful basis

For running the tools, keeping the site secure and measuring traffic in a cookieless way, our basis is legitimate interests — you asked for a result, and we need to operate and protect the service to give it to you.

For advertising cookies and any personalised advertising, our basis is your consent, collected through the consent message and withdrawable at any time.

6. How long we keep it

We keep no history of your lookups. Your query is processed when you make it and is not written to a database we control. Successful lookups for a given IP may sit in a CDN cache for up to 24 hours so we don't repeat the same request.

Our hosting, CDN and advertising providers keep their own operational logs under their own retention periods, which we do not control.

7. International transfers

Several of the providers above operate outside the United Kingdom, including in the United States. Where data reaches them, the transfer relies on the safeguards those providers put in place — typically UK adequacy regulations or standard contractual clauses with a UK addendum. Their own privacy policies set out the detail.

8. Cookies and advertising

The site itself does not set tracking cookies, and Cloudflare Web Analytics is cookieless.

Google AdSense does set cookies and may use advertising identifiers to measure and, with your consent, personalise ads. If you are in the UK or EEA you will be shown a Google consent message before personalised advertising is used.

You can change or withdraw your choice at any time using the “Privacy & cookie settings” link in the footer of any page carrying ads. You can also manage Google's own ad settings in your Google account.

9. Your rights

Under UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to how it is used, to data portability, and to withdraw consent at any time where consent is the basis.

In practice there is usually nothing for us to hand over, because we keep no lookup history and hold no account for you. If you believe we hold something about you, email [email protected] and we will respond within one month.

10. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Children

This site is not aimed at children and we do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, contact us and we will look into it.

12. Changes to this policy

If we add a tool or change a provider, we will update this page and the date at the top. Material changes will be noted here rather than made quietly.