What we collect, and why.

When you visit

Your browser sends your IP address with every request; that is how the internet works, and it is how we can show it to you. We use it to answer your request and, briefly, in an in-memory rate limiter that stops abuse. The application doesn’t write your IP to its database or to analytics. Registry and geofeed answers may be cached for a few days to keep pages fast, but we don’t keep a record of who looked up what.

Analytics are first-party and cookieless. We count page views and product events (for example “a domain report was run”) in our own database. Events never contain your IP address, a domain you checked or anything you typed. To count unique visitors without storing your IP, we keep a short hash of it combined with a secret that changes every day, plus a random identifier stored in your browser’s local storage. The country comes from our network provider’s country header. Analytics are kept for 25 months.

When you run a check

• Domain checks read public records (DNS, the domain’s TLS certificate and its registry RDAP record). The domain you type is used for the lookup.
• The DMARC report reader on the public site parses the file in your browser; it isn’t uploaded.
• The VPN check runs in your browser and keeps nothing unless you share a result.

When you share a report

Creating a shareable report stores what you chose to include (for example your IP address, the values each source returned and the date) under a random link, for 90 days. Anyone with the link can open it. We never include a browser fingerprint, and the device time zone only if you tick the box. You can save a report to your account to keep it longer, or ask us to remove one.

When you create an account

• Account: your email, name and a hashed password. Sessions store a hash of the session token and your browser’s user-agent string.
• Monitors: the domains you add, your settings, the daily checks of those domains (public records), the changes we detect and the alerts we create for you.
• DMARC uploads: the rows of the aggregate reports you upload: sending IP addresses, message counts and authentication results reported by receivers about mail using your domain. We process them only to show them to you.
• Email: we send alerts and a weekly digest to your account email only. Emails contain no tracking pixels and no tracked links; we log that an email was sent, not its contents.
• Security log: sign-ins and account changes are recorded with your account id so we can investigate misuse.

How long we keep it

The retention table on the policy page lists every item. In short: shared reports 90 days unless saved; monitors, alerts and uploads until you remove them; daily checks 13 months; analytics 25 months as counts. Deleting your account deletes your account data, monitors, alerts, saved reports and uploaded DMARC data.

Who else sees it

We don’t sell personal data and don’t share it with advertisers. We use infrastructure providers to run the service (hosting, our network provider, and an email delivery service for alerts once configured), who process data on our behalf. To answer lookups we query public services such as DNS-over-HTTPS resolvers and registry RDAP servers with the domain or address being checked, never with your identity.

Administrators of peekip see counts and aggregate figures, not the contents of your monitors or uploads.

Your choices and rights

You can export your data as JSON and delete your account at any time from Settings, and unsubscribe from any email with one click. Depending on where you live (for example under the GDPR or UK GDPR) you may also have the right to access, correct, restrict or object to processing, and to complain to your data protection authority.