Privacy Policy

Effective 21 July 2026.

Uplink Trace is a tool for tracing IP addresses against public network data. A service built on the premise that IP geolocation is approximate, and that it cannot identify an individual, would be in a strange position if it quietly hoarded data about its own visitors. So we do not. This policy explains, in plain language, exactly what we process, why, for how long, and what we deliberately choose not to do.

1. Who we are

Uplink Trace is operated by Altered Horizon Ventures, based in Montréal, Québec, Canada. For the purposes of the EU General Data Protection Regulation (GDPR), Québec's Law 25, and Canada's PIPEDA, Altered Horizon Ventures is the controller of any personal data processed through this site. You can reach us at any time at support@alteredhorizonventures.com or through the contact page.

2. What we process

Three categories, and nothing beyond them.

• Your own IP address. Every web server must see the connecting IP address to return a response; this is technically necessary and unavoidable. We additionally use it for one visible purpose: when you open the What is my IP page or ask the tracer to trace your own connection, we look your address up against our local geolocation database so you can see your own approximate region and network operator. That lookup happens on our server, in memory, at your request (a single trace also performs the reverse-DNS query described in section 6).
• IP addresses you submit. Addresses you type, paste, or upload — including batches sent to the bulk and log-analysis tools — are processed in memory to produce the result you asked for, and are then discarded. They are not written to a lookup history, and we build no record of who traced what.
• Minimal technical data. Our server keeps standard access logs: the requesting IP, the page requested, a timestamp, the browser's user-agent string, and the response status. We use these solely to keep the service running and to investigate abuse, and we delete them on a short cycle described in the retention table below.

3. What we do not do

• We do not persistently store the raw content of your lookups. Query results are generated, returned, and forgotten.
• We do not build visitor profiles, browsing histories, or interest categories.
• We do not sell, rent, or trade personal data. Ever, to anyone.
• We do not have the capability to identify individuals. IP geolocation resolves, at best, to an approximate region and a network operator — never to a person, household, or street address. If that limitation surprises you, our page on whether an IP reveals your address explains why it holds for everyone, including us.
• Server access logs are retained for a maximum of 30 days, for security purposes only, then deleted.

4. Legal bases

Where the GDPR applies, we process the data above under legitimate interest (Article 6(1)(f)): providing the service you requested, and keeping that service secure against abuse. We have weighed this interest against your rights and concluded the balance holds precisely because we minimise collection and retention so aggressively — the processing is limited to what the service cannot function without.

As a Québec-based operator, we are also subject to Law 25 (the Act respecting the protection of personal information in the private sector, as modernised) and to PIPEDA federally. The commitments in this policy are written to satisfy all three regimes simultaneously; where they differ, we apply the stricter standard.

5. Cookies and local storage

We set no cookies at all. The only browser storage we use is a single functional sessionStorage entry that remembers whether you have already seen the trace animation in your current tab, so it does not replay on every page. It contains no identifier, is never transmitted to us, and disappears when the tab closes.

There are no advertising or analytics cookies on this site today. If we ever introduce advertising, ad scripts will be gated behind a consent banner — they will not load until you agree — and this policy will be updated before that change goes live.

6. Third parties

• CARTO supplies the map tiles shown on dossier pages. Tiles are fetched directly by your browser, which means CARTO's servers see your IP address and the tile coordinates requested, as with any map embed. If you never load a page with a map, no request is made.
• DigitalOcean hosts our servers. As our infrastructure provider it processes traffic on our behalf under its own data processing terms.
• DB-IP publishes the geolocation database we use. We download the database to our own server and query it locally — your lookups are never sent to DB-IP or to any other geolocation service.
• The DNS system. To display a hostname for a traced address, our server performs a standard reverse-DNS (PTR) query for that address through the global DNS. Like any DNS query, this passes through our server's resolver and the DNS operators responsible for the address block. It carries only the IP address being traced — never your own identity or your IP.

That is the complete list. There are no analytics vendors, tag managers, social widgets, or tracking pixels.

7. International transfers

Our servers are operated by DigitalOcean and may be located in Canada, the United States, or the European Union. Canada holds an adequacy decision from the European Commission for commercial data transfers under PIPEDA. Where data transits other jurisdictions through our hosting provider, it does so under that provider's standard contractual safeguards. Given our 30-day retention ceiling and the absence of stored lookup content, the practical exposure from any transfer is deliberately small.

8. Your rights

Depending on where you live, you have the right to access, correct, delete, and receive a copy of personal data we hold about you, to object to or restrict processing, and to withdraw consent where processing rests on consent. Under Law 25 you may also request information about how your data is handled and file a complaint with the Commission d'accès à l'information du Québec; under the GDPR you may complain to your local supervisory authority; California residents have analogous rights under the CCPA, including the right to know and delete — and since we sell no personal data, there is nothing to opt out of selling.

To exercise any of these rights, email support@alteredhorizonventures.com. One honest caveat: because we do not retain lookup data and keep access logs only briefly, in most cases we will genuinely hold nothing about you to produce or delete. We will tell you so plainly rather than inventing a process.

9. Retention

10. Children

Uplink Trace is a network diagnostics tool and is not directed at children. We do not knowingly collect personal data from anyone under 13 (or the higher age your jurisdiction sets). Since we collect almost nothing from anyone, there is no registration, no profile, and no mechanism through which a child could hand us personal information beyond the transient technical data described above.

11. Security

All traffic to the site is served over HTTPS. Lookup endpoints are rate-limited to blunt scraping and abuse. Above all, our strongest security measure is structural: data that is never stored cannot be breached. Minimal collection and a hard 30-day log ceiling mean the worst-case contents of our servers stay small on any given day.

12. Changes to this policy

If our practices change — for instance, if advertising or analytics are ever introduced — we will update this policy first and change the effective date at the top. Material changes will be noted prominently on the site before they take effect. The current version always lives at this address, alongside our terms of service, and questions about either are welcome at support@alteredhorizonventures.com.