Privacy Policy

Internet Speed Test

The test runs only when you choose Start and transfers at most approximately 150 MiB per run, excluding headers and ping responses, between your browser and the IP Lens server. Payloads are processed transiently in bounded chunks; the application does not persist payloads or results in its database, analytics table, cache or application-controlled logs. Expiring request-limit records use HMAC keys derived from the IP for abuse prevention; they contain no payloads or measurement results.

Results reflect the route to this server, may be below the ISP's advertised speed and do not certify a plan's speed.

Information processed

The server necessarily receives an IP address when a browser connects. IP Lens uses it to display connection details, apply abuse limits and perform optional network lookups. Browser checks read only capabilities needed to show the result on the page.

When the operator enables visitor identity storage, exact IPs are retained long-term in a separate AES-256-GCM encrypted table to deduplicate visit history. Only an authenticated administrator can view decrypted values. The view does not show URLs visited by an identity; bots are grouped by bot name and IP.

The web server or hosting provider may keep access and error logs independently of the application cache. The operator is responsible for configuring and disclosing that retention.

Cache design

Approximate country, city, network owner, ISP and ASN data is cached by IPv4 /24 or IPv6 /48 for 30 days by default. That cache does not keep the exact IP.

Short-lived network-risk and rate-limit records use a keyed one-way identifier derived from the IP. Risk retention is 24 hours by default. IP Lens does not create user accounts or account-linked visit histories.

First-party visit statistics

When JavaScript is available, IP Lens records one page view with UTC time, page path, approximate country, browser, operating system, device type, language, time zone, screen-size bucket and referring host.

Recognized bots are recorded server-side after successfully loading public HTML pages. Classification uses the User-Agent and stores only a normalized bot family and category, never the full User-Agent. User-Agents can be spoofed: this is unverified classification, with no reverse DNS or external bot-detection service. Bot recording does not call a network-information provider; a country code is taken only from Cloudflare when configured as trusted.

The raw IP is not written to the page-view table. Human rows store only a masked network hint such as 203.0.113.xxx (approximate IPv4 /24) or 2001:db8:85a3:… (approximate IPv6 /48), allowing an authenticated operator to see a few recent visits without a full IP address. Bot rows do not store this hint. Both human and bot events use an HMAC derived from the IP and UTC date that changes each day. Only human keys contribute to visitor-days, which do not represent unique people across multiple days. The masked hint follows the page-view retention period, which defaults to 180 days and can be reduced in config.

Encrypted visitor identities

When enabled, exact IPs are encrypted with AES-256-GCM in a separate lifetime table; humans are deduplicated by IP and bots by bot name plus IP. Only an authenticated administrator can view decrypted values. These records do not include visited URLs, full User-Agents, encryption keys or ciphertext in admin output.

External services

Location and provider details normally come from the DB-IP Lite databases stored on the IP Lens server, so that lookup sends your IP address nowhere. Only if those databases are unavailable may the server send the IP to the fallback provider ipwho.is. If weather is enabled, the server sends approximate coordinates to WeatherAPI.com and caches current conditions for the configured TTL. To show both IPv4 and IPv6 addresses, your browser contacts api.ipify.org and api6.ipify.org. The WebRTC test may use the public STUN services of Google and Cloudflare. Icons and flags load from the cdnjs and jsDelivr CDNs, which receive your IP address as part of any normal web request. The WHOIS tool sends only the domain you enter to rdap.org and the domain registry; the DNS lookup uses the IP Lens server's resolver.

The map uses approximate coordinates inferred from an IP address, not a precise GPS location. Only when you open connection details and coordinates are available does your browser load the map and send a request to Google Maps. Google Maps receives your connecting IP address and the approximate coordinates in that map request; this page sends no referring page address. If you use the Google Maps fallback, your browser opens Google with the same approximate coordinates; no request is sent to Google until you choose the link.

Anonymous speed-test statistics

When a speed test completes, IP Lens stores the measured download, upload, ping and jitter together with the network provider (ASN), country and region derived from your IP address. Your IP address itself is not stored. These anonymous results are combined into the public Internet Speed by Provider page, which only lists providers with at least 10 results.

Contact form

When you send a message, IP Lens stores your name, email address, chosen topic, message and the time it was sent so we can reply. Your IP address is stored only as a keyed one-way hash used for spam protection. If the operator has enabled notification email, the same message is also emailed to the operator. Messages are kept only as long as needed to handle your request; ask us through the contact page to have them deleted.

Google AdSense advertising and cookies

This site may display advertising served by Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.

Google's use of advertising cookies (such as the DoubleClick cookie) enables it and its partners to serve ads based on your visits to this and other sites. You can opt out of personalised advertising in Google Ads Settings, or opt out of third-party vendor cookies at aboutads.info. Learn how Google uses information from sites that use its services.

Visitors from the European Economic Area, the United Kingdom and Switzerland are asked for consent through a Google-certified consent management platform (CMP), and can change their choice at any time. Google Analytics, when enabled, is used only for aggregated visit statistics.

Your choices

You can stop using the service, block JavaScript, disable WebRTC or avoid optional tests. Blocking JavaScript limits interactive results.

Last updated: October 18, 2026. For questions or privacy requests, please contact us.