Privacy Policy

Last updated: January 1, 2026

This Privacy Policy explains how ipmap.dev ("we," "us," or "our") collects, uses, and protects your information when you use our Service.

1. Information We Collect

Data	Why we collect it	Retention
Email address	Account identification, login links, service notifications	Until account deletion
IP addresses (your servers)	DNS record creation — core service functionality	Until subdomain deletion
IP address (your device)	Rate limiting and abuse prevention	2 hours (hashed)
Payment data	Billing via Paddle — we never store card numbers	Per Paddle's policy
Support messages	Resolving your support requests	12 months after closing
Session tokens	Keeping you logged in to the dashboard	30 days or until logout

We do not collect browsing history, sell your data to third parties, or use your data for advertising.

2. How We Use Your Information

• Providing and improving the Service
• Sending transactional emails (login links, billing receipts, support replies)
• Detecting and preventing abuse, fraud, and policy violations
• Complying with legal obligations

3. Third-Party Services

We share limited data with trusted third parties to operate the Service:

• Cloudflare — DNS hosting. Your subdomain names and server IPs are stored as DNS records.
• Paddle — Payment processing. Your email and payment details are processed by Paddle under their privacy policy.
• Google Safe Browsing — Subdomain names are checked against phishing/malware databases for abuse prevention.

4. Data Security

We implement technical and organisational measures to protect your data including encrypted connections (HTTPS), hashed session tokens and magic link tokens, and rate limiting on all sensitive endpoints. API keys are stored in plaintext but displayed only once to minimise exposure.

5. Cookies and Local Storage

The dashboard stores your session token in localStorage to keep you signed in. We do not use advertising or tracking cookies. We do not use any analytics platforms (Google Analytics, Mixpanel, etc.).

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your subdomain data

To exercise any of these rights, contact us at [email protected]. We respond within 30 days.

7. Data Retention

We retain your data for as long as your account is active. After account deletion, personal data is removed within 30 days. Anonymised aggregate statistics may be retained indefinitely.

8. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [email protected].

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. Continued use of the Service after changes constitutes acceptance of the revised policy.

10. Contact

For privacy-related questions, contact us at [email protected].