Privacy Policy

Summary

MyVPNCheck is a free, browser-based diagnostic tool. We do not require accounts, we do not save your scan history, and we do not track you by default. This policy explains exactly what data is processed and why.

Data We Process

1. Public IP Address (Required)

When you visit MyVPNCheck, Cloudflare's edge network sees your connecting IP address. Our /api/ip-info endpoint reads this from Cloudflare's request headers (cf-connecting-ip) and returns it to your browser so you can see it.

• Purpose: Display your public IP and approximate network metadata
• Retention: Not stored. Returned in API response only. No application logs.
• Legal basis: Legitimate interest (providing the service you requested)

2. Network Metadata (Conditional)

If available from Cloudflare, we also return: country code, region, city, ASN, and network organization.

• Source: Cloudflare edge metadata (geolocation/IP intelligence)
• Retention: Not stored. Returned in API response only.
• Accuracy: Approximate — identifies ISP/VPN exit region, not physical location

3. HTTPS Round-Trip Measurements

Your browser measures latency to our /api/health endpoint using performance.now().

• Purpose: Show connection responsiveness
• Retention: Calculated in browser, displayed in UI, not sent to server

4. WebRTC ICE Candidates

During the WebRTC test, your browser gathers ICE candidates via a STUN server. These include local network addresses (often masked as mDNS .local names) and server-reflexive public addresses.

• Processed in browser only: Never sent to our server
• STUN server: Receives connection metadata (your IP, port, timestamp). We use Google's public STUN servers by default (stun.l.google.com:19302), configurable via PUBLIC_STUN_SERVER_URL.
• Retention: Discarded when you reset or leave the page

What We Do NOT Do

• No persistent storage — No database, no localStorage for results, no cookies for tracking
• No user accounts — No registration, no login, no profiles
• No analytics by default — Cloudflare Web Analytics is disabled unless explicitly configured
• No third-party trackers — No Google Analytics, Meta Pixel, or ad tech
• No IP logging — We don't log IPs in application logs or analytics
• No scan history — Results vanish when you close the tab
• No data selling — We don't sell, rent, or share diagnostic data

Analytics (Opt-In Only)

If the site owner configures Cloudflare Web Analytics (by setting PUBLIC_ANALYTICS_ENABLED=true and providing a token), the following aggregate, privacy-respecting data may be collected:

• Page views (no unique identifiers)
• Referrer (aggregated, not per-user)
• Country (from Cloudflare edge, not precise location)
• Device type (desktop/mobile/tablet)
• Browser family

Cloudflare Web Analytics does not use cookies, does not fingerprint, and does not track individuals. It is GDPR-compliant by design.

Event tracking (if enabled): Only high-level events: scan_started, scan_completed, check_unavailable (check ID only), report_copied. Never: raw IP, precise location, STUN candidates, DNS tokens, or full reports.

External Services

• Cloudflare Workers — Hosting/runtime. Processes requests at the edge. See Cloudflare Privacy Policy.
• Google STUN Servers — Used for WebRTC ICE candidate gathering. Receives connection metadata. See Google Privacy Policy.

Your Rights

Since we don't store personal data, there's no data to access, rectify, or delete. If you believe we're processing data not described here, contact us below.