The rules we run peekip by.
A tool that judges VPNs and grades domains has to be clear about how it earns money and what it keeps. These are the commitments, in plain words.
How peekip will and won’t make money
- No VPN affiliate links, ever. The VPN check tells you whether your VPN works. We don’t earn anything when you buy, keep or switch a VPN, and we don’t rank VPN brands.
- No ads inside results. The answer to “what does the internet see about me?” and every domain report stay free of ads. If we ever show advertising, it will only be on reference pages, clearly marked, and never next to a verdict.
- No metering of your own IP. Seeing your own address, in the browser or with
curl peekip.com, is never counted against a quota. Rate limits exist only to stop abuse. - No surprise billing. The free plan monitors up to 3 domains. There is no card on file, so nothing can renew or charge you. If paid plans arrive, they will be opt-in and priced on the page before you choose them.
What we keep, and for how long
| What | Kept for | Why |
|---|---|---|
| Your IP address when you visit | Only in memory, in the rate limiter, for the length of the limit window | To stop abuse. The application doesn’t write it to its database or to analytics. |
| Shared reports (evidence reports, VPN results, domain snapshots) | 90 days, unless you save one to your account | So the link you sent still works. You choose what goes in; we never add a browser fingerprint. |
| Saved reports | Until you remove them or delete your account | You asked us to keep them. |
| Monitored domains and their alerts | Until you remove the domain or delete your account | That is the monitor. |
| Daily checks and detected changes for monitored domains | 13 months; 30 days after nobody monitors the domain any more | For the history graph and “what changed”. These are public DNS, certificate and registry records. |
| DMARC reports you upload | Until you delete them, remove the domain or delete your account | To show who sends as your domain. |
| Analytics | 25 months, as counts | First-party and cookieless. No IP address is stored; unique visitors are counted with a hash whose salt changes every day. |
You can download everything tied to your account as JSON from Settings, and deleting your account deletes it. The full detail is in the privacy notice.
How we report what we find
- Every value names its source and the date we checked it. A source we couldn’t check says “Not checked”, never a guess.
- We don’t say “Netflix will accept you” or “you’ll reach the inbox”. We say what the sources we checked show, and what we can’t see.
- Maps show regions, never a pin on a house. IP location is an estimate.
- We don’t help find other people. An IP lookup shows the network and its abuse contact, not a person.
- We don’t publish statistics, reviews or user counts we haven’t measured ourselves, with the method linked.
What our checks touch
Domain reports and monitors read public DNS (through public DNS-over-HTTPS resolvers), the TLS certificate on port 443 of the domain, and the registry’s RDAP record. They don’t scan ports or try to log in to anything. Monitoring a domain needs no proof that you own it because everything we read is public; alerts only ever go to the email on your account.