Privacy Policy
This policy covers the IP99 website and API, operated by THREATHUNTER TECHNOLOGIES PTE. LTD. (Singapore). It describes what we do with data when you use the service, and — where it matters — what we deliberately do not keep.
In effect since . See also our terms of service.
1. The short version
- You can use the free tier without an account. No email, no cookie, no signup.
- The address you look up is stored in our request log, because that log is how limits are enforced and abuse is investigated.
- Your own IP address is not stored in our analytics in plain text. It is turned into a salted hash before it is written.
- We run no advertising or third-party analytics, and we do not sell data.
- Looking up a phone number leaves nothing behind on our side. See section 3.
2. What we collect, and why
We keep this list short on purpose. Each item below exists because something in the service does not work without it.
2.1 The address you look up
When you call the API or use a lookup page, the IP address (or phone-related query) you asked about is recorded, together with the time, the endpoint, the response status, and the key or client IP that made the call.
Why: to enforce the daily limits, to bill paid plans accurately, and to investigate abuse of the service. This is the one piece of query content we retain, and it is the field we would remove first if we could — bulk enumeration is exactly what the terms forbid, and detecting it requires seeing it.
2.2 Your own IP address
Your request necessarily arrives with your IP address attached. We use it transiently to route the request and to apply rate limits.
For visit statistics we do not keep it in plain text. It is combined with a server-side salt and hashed, and only the hash is stored — enough to count distinct visitors and see returning ones, not enough to read your address back out of the analytics database. We also record coarse, non-identifying request context: user-agent string, referrer when your browser sends one, and the country and province our own geolocation returns for the request itself.
If your visit carries the utm_source / utm_medium campaign
tags (we put them on our outbound links), we keep the value of those two keys only, and
only when the value is on our fixed list of channel names. The rest of the query string
is not kept — other parameters on the same URL (tokens, email addresses) do not reach
the database.
One honest limitation: because the salt is stable over time, the hash is pseudonymous, not anonymous. Anyone who had both the salt and your IP address could confirm a match. That is why the salt is treated as a secret and why we describe this as pseudonymisation rather than claiming the data is anonymous.
2.3 Account data
If you create an account: the email address you sign in with, a password hash, optional OAuth identifiers if you sign in that way, and the API keys you generate. If you subscribe to a paid plan, also the plan and its status.
Why: to authenticate you, to issue and revoke keys, and to apply the correct limit.
2.4 Payments
Paid plans are processed by Stripe. Your card details go directly to Stripe and we never receive or store them. We hold only what is needed to know whether a subscription is active: a customer and subscription identifier, the plan, and billing status. Stripe processes that payment data under its own privacy terms.
3. Phone number lookups: what we deliberately do not keep
If you use the phone-number endpoints, the numbers you submit are not written to our query log, not exposed to our metrics system, and not placed in a URL. The request is forwarded and the upstream response is streamed back without being parsed into our process, so a number does not end up on our heap, in an error message, or in a crash dump.
This is not a promise about intentions; it is a set of things the code does not do, and we keep it that way because a phone number identifies a person far more directly than an IP address does. Numbers therefore do not appear in your usage dashboard either — the dashboard counts the lookups, not the numbers.
4. Cookies
We set one cookie of our own:
ip99_lang— remembers whether you chose the Chinese or English site, so we do not have to guess on your next visit. Set only when you use the language switcher, kept for one year,SameSite=Lax.
A session cookie is set if you sign in, and it is required for the account to work. We run no advertising, tracking or third-party analytics cookies. Because we do not use cookies for analytics, there is no cookie banner to dismiss — the one cookie we set exists to honour a choice you made.
5. What we do not do
- We do not sell your data, and we do not share it with data brokers.
- We do not use your request log to build profiles of the people behind the addresses you look up, and we do not resell the queries.
- We do not put phone numbers into metrics labels or logs (section 3).
- We do not send marketing email without your opt-in.
6. Who else processes data
A small number of providers handle data on our behalf, and only for the purposes above:
- Stripe — payment processing and subscription billing.
- Infrastructure providers — servers and networking that host the service.
- Email delivery — transactional mail such as sign-in links and limit notices.
We may also disclose data where the law requires it, or where it is necessary to investigate an attack on the service. If we are ever required to hand over data, we disclose the minimum necessary and, where we are permitted to, we tell the account holder.
7. Where your data is processed
The service is operated from Singapore, and our servers and those of the providers listed above may be located in Singapore, the European Union, the United States or elsewhere. That means data may be transferred outside the country you are in, including outside the European Economic Area.
Where personal data originating in the EEA is transferred, we rely on appropriate safeguards — in practice the European Commission's standard contractual clauses with the providers concerned. Our servers are currently located in Hong Kong and mainland China; the providers in section 6 are the parties that may process data further afield.
8. How long we keep it
| Data | Kept for |
|---|---|
| Visit and request log (including the address you looked up) | 90 days, then deleted automatically by a scheduled job |
| Your own IP address in analytics | Never stored in plain text — only the salted hash, for the same 90 days |
| Phone numbers you submit | Not retained at all (section 3) |
| Account and API keys | Until you delete the account |
| Billing records | As long as tax and accounting law requires |
| Language cookie | One year, or until you clear it |
9. Security
Data is transmitted over HTTPS. API keys are stored so that they can be verified without being recoverable in plain text, and you can revoke any key at any time. Access to production data is limited to what operating the service requires.
No service can promise perfect security. If we become aware of a breach that affects your personal data, we will notify affected account holders and the relevant authority where the law requires it.
10. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you, and receive a copy.
- Correct it if it is wrong.
- Delete it — ask us to delete your account and we delete it, including its API keys. Records we must keep for accounting or to comply with the law are kept for as long as the law requires, and nothing longer.
- Object to or restrict certain processing, and to withdraw consent where we relied on consent.
- Complain to your local data protection authority. In Singapore that is the PDPC; in the EU/EEA it is the authority in your country of residence.
Our legal bases for processing are: performance of a contract (providing the service and billing for it), legitimate interests (keeping the service available, preventing abuse, and securing it), and legal obligation (tax and accounting records). We do not rely on consent for the processing described in this policy, because none of it is optional if you want the service to work.
11. Children
IP99 is a developer and security service, not a consumer product, and it is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
The date at the top says which version is in effect. If a change materially affects what we do with personal data, we email account holders before it takes effect — the free tier without an account is not affected by most changes, because we hold nothing that identifies you.
13. Contact
Questions about this policy, or a request to access or delete your data: tim@threathunter.com. Include the email address on the account if you have one. We answer data requests within 30 days.
THREATHUNTER TECHNOLOGIES PTE. LTD., Singapore. See also our terms of service.