Skip to content
IP IPBot
Get Started

Privacy

Privacy Policy

IPBot does not build lookup histories or behavioral user profiles. The service still processes limited request, account, rate-limit, and operational-cache data needed to provide and protect the API.

What we process

  • Client IP address (used to fulfill the request)
  • User-Agent and basic request headers (used for telemetry signals)
  • The IP address explicitly submitted for lookup
  • GitHub account identifiers, profile fields, sessions, and API-key metadata when you sign in
  • Per-key usage counters and last-used timestamps

Logging

Application request logs use canonical route names and bounded client classes such as browser, automation, API client, or unknown. They include status, timing, response size, and access tier for reliability work, without storing the raw request path, raw User-Agent, or a client-IP hash in the application log. Infrastructure providers still process source IPs to route traffic and mitigate abuse.

Rate limiting and sessions

Anonymous rate limiting uses a pseudonymous identifier derived from the client IP. Authenticated use stores API-key hashes and prefixes, key names and tiers, usage counters, and session records. Plaintext API keys are shown only at creation time. Session duration defaults to seven days and can be configured by the operator.

Operational data caches

Registration and allocation lookups may be cached to reduce external RDAP traffic and improve resilience. The default fresh and stale windows can retain normalized cache records for up to approximately 37 days. Pro-only contact data, when explicitly requested and authorized, may be present in that normalized cache. Raw RDAP responses and raw WHOIS text are not stored by IPBot.

Data sources

IPBot uses locally managed intelligence data for geolocation, network classification, and public risk signals.

Questions and deletion requests

For questions about stored account data or a deletion request, contact hello@ipbot.com. Account deletion is currently handled as an operator request rather than a self-service workflow.