Skip to main content
WorldIP.io

Privacy Policy

Last updated: July 18, 2026

Overview

WorldIP.io is a public IP-address and network-intelligence service operated by Tuxxin LLC. We are built around a simple principle: the data we publish is public network data, and the personal data we collect about you is kept to a minimum. Web lookups are free and require no account. An optional free account (Sign in with Google) unlocks higher daily limits and API access. We do not sell personal information, we do not store payment-card details, and you can permanently delete your account and all of its data yourself at any time.

Data controller

For purposes of the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA/CPRA), and similar state laws, the data controller is:

Tuxxin LLC
Orlando, FL, United States
Contact: contact form

For full legal disclosure information required under German law, see our Impressum. For a technical overview of how we secure the service, see our Security Overview.

The network data we publish is not personal data

The core of WorldIP.io is a database of the public IPv4 (and IPv6) address space — allocation ownership, ASN, organization, country/city geolocation, CIDR ranges, reverse-DNS (PTR) hostnames, forward-DNS associations, routing (BGP/RPKI) and reputation signals. This information describes networks and address blocks, not identified individuals, and is compiled from authoritative public sources — MaxMind GeoLite2, the ipinfo Lite dataset, IANA and RIR (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) delegation files, public DNS, GRIP (General Research IP) forward-DNS, public RDAP/WHOIS, RIPE RIS routing data, and public threat-intelligence blocklists. Where this data incidentally relates to an identifiable person, we process it under the legitimate-interests basis described below.

What we collect about you

  • Search queries — When you look up an IP address, we log the query (not your identity) with a one-way hash of your IP + user agent for rate-limiting and abuse-prevention. This hash cannot be reversed to identify you.
  • Account (Sign in with Google) — If you create an account, we receive from Google and store your email address, name, profile picture, and a Google account identifier, used solely to operate your account and apply per-account limits. We never receive your Google password and request no access to your Google data beyond basic profile and email. Sign-in state is held in a stateless, HMAC-signed cookie (wio_auth) — we keep no server-side session store of your credentials. You can permanently delete your account and all of this data at any time from your account page.
  • API keys — If you generate an API key, we store only a SHA-256 hash of the key (never the key itself) together with its scope, rate limit, optional origin/IP lock, and basic usage counters (last-used timestamp, request count). We cannot recover a lost key — you regenerate it.
  • Google Analytics 4 — We use GA4 for aggregate traffic analysis (page views, geographic distribution, device types). GA4 operates under Google Consent Mode v2. For visitors in the EEA, the UK, and Switzerland, analytics cookies are set only after you click “Accept” on the consent banner; until then GA4 uses cookieless, modeled data with no personal identifiers. Elsewhere, analytics is enabled by default and you may opt out at any time via the “Cookie settings” link in the footer or your browser’s Do Not Track / Global Privacy Control signal, both of which we honour.
  • Google AdSense — When enabled, ads may use cookies for personalization only with your consent. Without consent, non-personalized ads are shown. AdSense also operates under Consent Mode v2.
  • Microsoft Clarity — We use Microsoft Clarity, a product-analytics and session-replay service provided by Microsoft Corporation, to understand how visitors use the site (pages viewed, clicks, scrolling, and general usage patterns) through behavioral metrics, heatmaps, and reconstructed session recordings. Clarity uses first- and third-party cookies and similar technologies to record and aggregate this activity; Microsoft processes the data it collects in accordance with its own privacy practices — see the Microsoft Privacy Statement. Like our other analytics, Clarity is covered by the “Cookie settings” control in the footer and by your browser’s Do Not Track / Global Privacy Control signal.
  • Contact form — If you submit the contact form, we receive your name, email, and message via MailerSend. This data is used solely to respond to your inquiry.
  • Newsletter — If you ask to be notified about new features or the API, we store the email address you provide until you unsubscribe.
  • Server logs — Standard web-server logs (IP address, request URL, user agent, timestamp) are retained for 90 days for security and debugging purposes.

Payments

WorldIP.io does not currently process payments, and we do not store, transmit, or have access to your payment-card details at any time. Paid API plans are planned; when billing launches it will be handled by a PCI-DSS-compliant third-party payment processor (Stripe), and card data will be entered directly with that processor — WorldIP.io will never see or store your full card number. This section will be updated with the applicable billing details before any paid plan goes live.

Legal basis for processing (GDPR / UK GDPR)

We process personal data on the following legal bases under Article 6(1) of the GDPR and UK GDPR:

  • Consent (Art. 6(1)(a)) — Google Analytics, Microsoft Clarity, Google AdSense personalization, and any other non-essential cookies. Consent is collected via our cookie banner and may be withdrawn at any time via the “Cookie settings” link in the footer, which clears your wio_consent preference and re-opens the consent banner for a fresh choice.
  • Legitimate interests (Art. 6(1)(f)) — server logs for security, abuse prevention, and debugging; rate-limiting via hashed IP/user-agent; and aggregating publicly visible reverse-DNS data, public IP-allocation datasets (MaxMind GeoLite2, RIR delegation files, ipinfo Lite), forward-DNS associations from GRIP, routing data and public blocklists into our database. Our legitimate interests in operating, securing, and improving a public lookup service have been balanced against your reasonable privacy expectations.
  • Performance of, or steps prior to, a contract (Art. 6(1)(b)) — operating your account; processing your contact-form submission to reply to your inquiry; and, once billing launches, processing an API subscription you request.
  • Legal obligations (Art. 6(1)(c)) — retention or disclosure where required by a valid legal process.

Cookies

We use the following cookies and local-storage items:

  • PHPSESSID — Essential session cookie for CSRF protection on the contact form. Set only when needed; no personal data stored.
  • wio_auth — Essential, HMAC-signed login cookie, set only after you sign in (HttpOnly, Secure, SameSite=Lax). Keeps you signed in across our servers without a server-side session; cleared on sign-out or account deletion.
  • wio_hint, wio_csrf — Essential helper cookies for signed-in users (a presence-only account-menu hint and a CSRF token). No personal data.
  • wio_consent — Stores your cookie-consent preference (browser localStorage, not a cookie).
  • _ga, _ga_* — Google Analytics cookies. In the EEA/UK/Switzerland they are set only after you accept analytics; elsewhere they are set by default and can be cleared by opting out via “Cookie settings” (or DNT/GPC).
  • Google AdSense / DoubleClick cookies — only set if you accept advertising cookies.
  • _clck, _clsk, CLID — Microsoft Clarity cookies (set via clarity.ms), used to stitch page views into a single session for behavioral analytics, heatmaps, and session replay.
  • ANONCHK, MR, MUID, SM — Microsoft / Bing cookies (set via c.bing.com) associated with Clarity for the same analytics and session-replay purposes.

Under the UK Privacy and Electronic Communications Regulations (PECR) and Germany’s Telecommunications-Telemedia Data Protection Act (TTDSG / TDDDG), non-essential cookies require prior consent. Our consent banner provides an opt-in for each category.

Accounts & account deletion (right to erasure)

Accounts are optional and free. We authenticate you with Sign in with Google (OAuth 2.0) and never handle your Google password. The only personal data tied to your account is the email, name, profile picture, and account identifier we receive from Google, plus any API keys (stored hashed) and per-account usage counters you generate.

You can permanently delete your account at any time from your account page. Deletion is immediate and self-service: it removes your account record and cascades to every associated row (usage counters, feed and API tokens), and it signs you out. This is a genuine erasure of the data we hold — you do not need to email us or wait for a manual review.

Your rights under GDPR / UK GDPR

If you are in the EU/EEA, the UK, or Switzerland, you have the following rights regarding your personal data:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — request correction of inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — request deletion of your data where one of the GDPR grounds applies. For account data, you can do this yourself instantly from your account page.
  • Right to restriction — ask us to limit how we use your data while a dispute is resolved.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object — object to processing based on legitimate interests, including for direct marketing.
  • Right to withdraw consent — withdraw cookie or other consent at any time, without affecting the lawfulness of prior processing.
  • Rights related to automated decision-making — we do not make decisions about individuals based solely on automated processing.

To exercise any of these rights, use our contact form. We will respond within one month, in line with Article 12 GDPR.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. Key authorities include:

  • United Kingdom — Information Commissioner’s Office (ICO), ico.org.uk
  • Germany — Federal Commissioner for Data Protection and Freedom of Information (BfDI), bfdi.bund.de, or the state DPA where you reside.
  • Other EU/EEA states — your national data protection authority. A list is available at edpb.europa.eu.

International data transfers

Tuxxin LLC is based in the United States, which has not received a general EU adequacy decision. When personal data is transferred from the EU/EEA, the UK, or Switzerland to the United States or to other third countries, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum (IDTA), together with supplementary safeguards appropriate to the data involved. Cloudflare (our CDN and security provider), Google (Analytics / AdSense / Sign-in), and Microsoft (Clarity) each operate under their own published transfer mechanisms — see their respective policies for details. By using WorldIP.io, you acknowledge that data may be processed in the United States.

Your rights under California law (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the following rights:

  • Right to know what categories of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it.
  • Right to delete personal information we hold about you, subject to legal exceptions.
  • Right to correct inaccurate personal information.
  • Right to limit the use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA.
  • Right to opt out of “sale” or “sharing” for cross-context behavioral advertising — see below.
  • Right to non-discrimination — we will not deny service, charge a different price, or provide a different level of quality because you exercised a CCPA right.

Categories of personal information we collect: Internet or other electronic network activity information (IP address, user-agent, page URL, search queries); account identifiers (name, email, profile picture, Google account ID) if you sign in; and identifiers you choose to provide via the contact form or newsletter (name, email). We collect this directly from you (your browser request or sign-in) and use it for the service-delivery, security, and analytics purposes described above. We disclose limited information to our service providers (Cloudflare, Google, Microsoft, MailerSend) as needed to operate the service.

Sale and sharing: We do not sell personal information for money. Outside of operating the WorldIP.io service itself and serving ads through Google AdSense (which may constitute “sharing” for cross-context behavioral advertising under the CPRA when you have consented to advertising cookies), we do not share personal information with any third party for any purpose. If you have not opted in to advertising cookies via our consent banner, no sharing for behavioral advertising occurs.

To exercise CCPA rights: use our contact form. We will verify your request using the information you provide and respond within the timeframes required by the CCPA (generally 45 days).

Children’s privacy

WorldIP.io is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. This minimum age reflects the higher of the COPPA threshold (13 in the United States) and Germany’s national choice under Article 8 GDPR (16). If you believe a child has provided us personal data, please contact us and we will delete it.

PTR / reverse DNS data

WorldIP.io scans public DNS PTR records for allocated IPv4 addresses. This is publicly available DNS data — no different from running dig -x on any IP. PTR records contain hostnames set by IP block owners, not personal information. We do not scan ports, probe services, or make application-level connections to the IPs themselves. PTR records that reference your IP can be modified by the network operator (typically your ISP or hosting provider); WorldIP.io does not control PTR content.

Data retention

  • Hashed search logs: 18 months, then deleted.
  • Account data: kept while your account is active; erased immediately when you delete your account.
  • Server logs (request URL, IP, user-agent, timestamp): 90 days.
  • Contact form submissions: until your inquiry is resolved, then deleted (typically within 90 days of last reply).
  • PTR records: refreshed continuously based on DNS TTL values; superseded records are overwritten.

Service providers and recipients

We use the following service providers, each of which acts as a processor or independent controller under its own terms:

  • Cloudflare, Inc. — CDN, TLS, and DDoS protection. See Cloudflare’s privacy policy.
  • Google LLC — Sign in with Google (OAuth), Google Analytics 4, and Google AdSense (the latter two under Google Consent Mode v2). See Google’s privacy policy.
  • Microsoft Corporation — Microsoft Clarity product analytics, heatmaps, and session replay. See the Microsoft Privacy Statement.
  • MailerSend — transactional email delivery for contact-form replies. See MailerSend’s privacy policy.
  • Proton AG (affiliate program) — we display affiliate links to Proton VPN and Proton Unlimited and may earn a commission on signups originating from those links. An impression-tracking pixel from go.getproton.me is loaded only after you accept advertising cookies via our consent banner; without consent the affiliate link is still rendered but no pixel fires. The pixel transmits an anonymous, per-day-rotated hash of your IP + user-agent (used for click attribution) to Proton. See Proton’s privacy policy.

When paid API billing launches, our payment processor (Stripe) will be added to this list as an independent controller for the card data you enter directly with it. Beyond these providers, we share no personal data with any third party except where required by law.

Affiliate disclosure

Some outbound links on WorldIP.io are affiliate links — most notably to Proton VPN and Proton Unlimited. If you click one and subsequently sign up for a paid plan, we may earn a commission from Proton at no additional cost to you. Affiliate placements are marked with “sponsored”, “(affiliate link)”, or an “Ad” badge, and we only recommend products we believe are useful to the WorldIP.io audience. Our editorial content (page text, data, methodology) is not influenced by these partnerships.

Data security

We use HTTPS (TLS 1.2+) on all connections, set our authentication and session cookies as HttpOnly, Secure, and SameSite=Lax, hash IP addresses where used for rate-limiting, store API keys only as SHA-256 hashes, do not store payment-card data, and restrict server access to authorized operators over a private management network. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security. For a fuller description of our controls, see our Security Overview.

Data breach notification

In the event of a personal-data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority without undue delay (and, where feasible, within 72 hours) as required by Article 33 GDPR, and notify affected individuals where Article 34 GDPR or applicable US state law requires it.

Do Not Track and Global Privacy Control

We honour the DNT (Do Not Track) browser header and the Global Privacy Control (Sec-GPC) signal. When either is detected, analytics and advertising cookies are automatically declined and treated as an opt-out of “sharing” under the CCPA/CPRA.

Changes

We may update this policy as our practices evolve. Material changes will be reflected by an updated “Last updated” date at the top of this page. Continued use of WorldIP.io after the effective date constitutes acceptance of the revised policy.

Contact

Privacy questions, requests, or complaints: contact form, or use our contact form. Security-specific reports: contact form.

Share