Privacy Policy

1. Who runs this site

ipbox.one is an independent, single-purpose network diagnostics site run by an individual developer (GistWillan). There is no company behind it, no account system, and no sales team. For anything privacy-related, write to gistwillan@gmail.com — that mailbox reaches the person who maintains the code.

2. What is processed when you open a page

Two things happen. Your browser asks Cloudflare for the page, and the Worker that renders it reads the connection metadata Cloudflare has already attached to that request. Nothing extra is collected, and no script of ours runs to gather it.

• IP address (IPv4 and/or IPv6) — displayed back to you as the core of the diagnostic, and used as the key for API rate limiting.
• Autonomous system number, network operator name, and the country, city and approximate coordinates Cloudflare derives from the IP.
• Transport details: TLS version, cipher suite, HTTP protocol version, and the edge location (colo) that answered.
• Headers your browser sends on its own: User-Agent, Accept-Language, and the Sec-CH-UA client hints.
• The requested path, the timestamp and the response status — ordinary access logging.

None of this needs an account. There is no first-party tracking cookie, no cross-visit profile, and no analytics SDK loaded on the page.

3. Checks that run inside your browser

Some results are computed locally and never become a request to our server: the WebRTC test enumerates ICE candidates on your device. The IPv4 and IPv6 probes do leave your browser, but they go straight to the third-party echo services listed in section 6 — not through our Worker. Results are rendered in the page and disappear with the tab.

4. Short-lived storage at the edge

The diagnostics API keeps a rate-limit counter in Cloudflare KV under a key of the form your-ip:window, holding a single integer and expiring after roughly ninety seconds. It exists so the API cannot be used as a free lookup proxy for someone else. It is not joined to any log, and it is not read for any other purpose.

5. Cookies and local storage

ipbox.one sets no advertising or analytics cookies of its own. One value lives in your browser localStorage: your appearance choice (light, dark or system). It stays on your device.

Cloudflare may set strictly functional cookies while serving and protecting the site, for example bot-management cookies. Those are set by Cloudflare as the hosting provider, not by us, and they are not used to build advertising profiles by this site.

6. Other third parties the site contacts

• Cloudflare — hosting, CDN, DNS and the edge metadata described in section 2.
• check.torproject.org — the public Tor exit-node list, fetched by our Worker. No visitor data is sent with that request.
• ipv4.icanhazip.com / ipv6.icanhazip.com — single-stack address echo, called from your browser to test the IP family your connection did not use.
• edns.ip-api.com — returns the address of the DNS resolver that queried it, which is how your resolver is identified.
• ipwho.is — turns that resolver address into a country and operator label.
• IPQualityScore or IPHub — only when a risk provider has been configured, in which case your IP is sent to be scored.
• DNS-over-HTTPS resolvers and RDAP services — only when you use the DNS Lookup, Whois or port tools, and only with the domain or IP you typed yourself.
• upload.wikimedia.org — the CDN that serves the cover photographs used on articles (Wikimedia Commons). They load only when you open an article that has one, and the request carries your IP address and User-Agent; we never see or store those logs.

These services receive your IP address as an unavoidable part of the request. Their own privacy policies govern what they do with it; we do not receive, store or resell their logs.

7. How long data is kept

Rate-limit counters expire in about ninety seconds. Cloudflare retains edge request logs according to its own retention schedule for the plan in use. We keep no separate analytics database and no archive of visitor IPs. Reading an article, using a tool or running a diagnostic leaves no per-visitor record on our side.

8. Legal bases and your rights

Where the GDPR applies, serving the page and preventing abuse rest on legitimate interest. You may ask what is held about you, request erasure, or object to processing by writing to the address below. Because almost nothing is keyed to an individual, the honest answer will usually be that there is nothing beyond the current rate-limit counter — but you are entitled to ask, and you are entitled to a real answer.

California residents have equivalent rights under the CCPA/CPRA, including the right to know and the right to opt out of the sale or sharing of personal information. We do not sell personal information.

9. Children

This is a technical tool aimed at developers and system administrators. It is not directed at children under 13, or the equivalent minimum age where you live, and we do not knowingly process their data.

10. Changes to this policy

If a data flow changes — a new provider, a different service, longer log retention — this page is updated and the date at the top moves. Changes that affect what is collected are also announced in the blog rather than swapped in silently.

11. Contact

gistwillan@gmail.com. If your question is about a specific request, include the URL and the approximate time in UTC; that is usually enough to check the logs.