Privacy Policy

Effective 22 July 2026.

Uplink Trace is a tool for tracing IP addresses against public network data. A service built on the premise that IP geolocation is approximate, and that it cannot identify an individual, would be in a strange position if it quietly hoarded data about its own visitors. So we do not. This policy explains, in plain language, exactly what we process, why, for how long, and what we deliberately choose not to do.

1. Who we are

Uplink Trace is operated by Altered Horizon Ventures, based in Montréal, Québec, Canada. For the purposes of the EU General Data Protection Regulation (GDPR), Québec's Law 25, and Canada's PIPEDA, Altered Horizon Ventures is the controller of any personal data processed through this site. You can reach us at any time at support@alteredhorizonventures.com or through the contact page.

2. What we process

Four categories, and nothing beyond them.

• Your own IP address. Every web server must see the connecting IP address to return a response; this is technically necessary and unavoidable. We additionally use it for one visible purpose: when you open the What is my IP page or ask the tracer to trace your own connection, we look your address up against our local geolocation database so you can see your own approximate region and network operator. That lookup happens on our server, in memory, at your request (a single trace also performs the reverse-DNS query described in section 6).
• IP addresses you submit. Addresses you type, paste, or upload — including batches sent to the bulk and log-analysis tools — are processed in memory to produce the result you asked for, and are then discarded. They are not written to a lookup history, and we build no record of who traced what.
• Minimal technical data. Our server keeps standard access logs: the requesting IP, the page requested, a timestamp, the browser's user-agent string, and the response status. We use these solely to keep the service running and to investigate abuse, and we delete them on a short cycle described in the retention table below.
• Anonymous usage statistics. With your permission where the law requires it (see section 5), Google Analytics counts visits so we can see which pages are useful. It records pages viewed, device type, and approximate region against a random identifier — never your name, and never the addresses you look up: lookup targets and query strings are redacted from the page URLs it measures before anything leaves your browser.

3. What we do not do

• We do not persistently store the raw content of your lookups. Query results are generated, returned, and forgotten.
• We do not build visitor profiles or interest categories, and we run no advertising trackers. The only usage measurement is the redacted, consent-gated analytics described in section 5.
• We do not sell, rent, or trade personal data. Ever, to anyone.
• We do not have the capability to identify individuals. IP geolocation resolves, at best, to an approximate region and a network operator — never to a person, household, or street address. If that limitation surprises you, our page on whether an IP reveals your address explains why it holds for everyone, including us.
• Server access logs are retained for a maximum of 30 days, for security purposes only, then deleted.

4. Legal bases

Where the GDPR applies, we process the data above under legitimate interest (Article 6(1)(f)): providing the service you requested, and keeping that service secure against abuse. We have weighed this interest against your rights and concluded the balance holds precisely because we minimise collection and retention so aggressively — the processing is limited to what the service cannot function without. Analytics cookies are the exception: where they require consent (the EEA, the United Kingdom, Switzerland), we set them only after you agree (Article 6(1)(a)); elsewhere we rely on legitimate interest and honour the same reject switch at any time.

As a Québec-based operator, we are also subject to Law 25 (the Act respecting the protection of personal information in the private sector, as modernised) and to PIPEDA federally. The commitments in this policy are written to satisfy all three regimes simultaneously; where they differ, we apply the stricter standard.

5. Cookies and local storage

We use a small number of first-party cookies, each for a narrow purpose. A functional cookie (ut_lang) remembers your language when you use the switcher, and another (ut_consent) remembers your cookie choice; both are necessary for the feature they provide and identify nothing about you. The only other browser storage we use is a single functional sessionStorage entry that remembers whether you have already seen the trace animation in your current tab, so it does not replay on every page. It contains no identifier, is never transmitted to us, and disappears when the tab closes.

Analytics. We use Google Analytics 4 to count visits and understand which pages are useful. It sets _ga cookies holding a random identifier and reports pages viewed, device type, and the approximate region Google derives. We have configured it conservatively: advertising features, ads personalisation, and Google Signals are disabled, and the addresses you trace — along with all query strings — are redacted from the page URLs it measures, so your lookups never reach Google. In the EEA, the United Kingdom, and Switzerland these cookies are set only if you accept the consent banner; everywhere else you can turn them off at any time via “Cookie settings” in the footer. There is still no advertising on this site; if that ever changes, ad scripts will be gated behind the same consent banner and this policy will be updated before the change goes live.

6. Third parties

• CARTO supplies the map tiles shown on dossier pages. Tiles are fetched directly by your browser, which means CARTO's servers see your IP address and the tile coordinates requested, as with any map embed. If you never load a page with a map, no request is made.
• DigitalOcean hosts our servers. As our infrastructure provider it processes traffic on our behalf under its own data processing terms.
• DB-IP publishes the geolocation database we use. We download the database to our own server and query it locally — your lookups are never sent to DB-IP or to any other geolocation service.
• The DNS system. To display a hostname for a traced address, our server performs a standard reverse-DNS (PTR) query for that address through the global DNS. Like any DNS query, this passes through our server's resolver and the DNS operators responsible for the address block. It carries only the IP address being traced — never your own identity or your IP.
• Google Analytics measures site usage when permitted (see section 5). When it runs, your browser talks to Google's servers, which see your IP address and the redacted page URL. Google processes this on our behalf under its data processing terms; advertising features and data sharing beyond measurement are disabled.

That is the complete list. Beyond the consent-gated analytics above, there are no other analytics vendors, no tag managers, no social widgets, and no tracking pixels.

7. International transfers

Our servers are operated by DigitalOcean and may be located in Canada, the United States, or the European Union. Canada holds an adequacy decision from the European Commission for commercial data transfers under PIPEDA. Where data transits other jurisdictions through our hosting provider, it does so under that provider's standard contractual safeguards. Given our 30-day retention ceiling and the absence of stored lookup content, the practical exposure from any transfer is deliberately small.

8. Your rights

Depending on where you live, you have the right to access, correct, delete, and receive a copy of personal data we hold about you, to object to or restrict processing, and to withdraw consent where processing rests on consent. Under Law 25 you may also request information about how your data is handled and file a complaint with the Commission d'accès à l'information du Québec; under the GDPR you may complain to your local supervisory authority; California residents have analogous rights under the CCPA, including the right to know and delete — and since we sell no personal data, there is nothing to opt out of selling.

To exercise any of these rights, email support@alteredhorizonventures.com. One caveat: because we do not retain lookup data and keep access logs only briefly, in most cases we will genuinely hold nothing about you to produce or delete. We will tell you so plainly rather than inventing a process.

9. Retention

10. Children

Uplink Trace is a network diagnostics tool and is not directed at children. We do not knowingly collect personal data from anyone under 13 (or the higher age your jurisdiction sets). Since we collect almost nothing from anyone, there is no registration, no profile, and no mechanism through which a child could hand us personal information beyond the transient technical data described above.

11. Security

All traffic to the site is served over HTTPS. Lookup endpoints are rate-limited to blunt scraping and abuse. Above all, our strongest security measure is structural: data that is never stored cannot be breached. Minimal collection and a hard 30-day log ceiling mean the worst-case contents of our servers stay small on any given day.

12. Changes to this policy

If our practices change — for instance, if advertising is ever introduced, or our analytics configuration meaningfully changes — we will update this policy first and change the effective date at the top. Material changes will be noted prominently on the site before they take effect. The current version always lives at this address, alongside our terms of service, and questions about either are welcome at support@alteredhorizonventures.com.