Privacy policy

The short version

• No accounts, no sign-up, no email addresses collected.
• We use Google Analytics to count visits and tool use. It sets two cookies, and it learns which pages you view, which tools you use and what you look up (the domain, address or other value you enter). The Google Analytics section below lists everything it is sent.
• No advertising, and we do not sell or rent your data.
• No raw IP addresses in our own logs: only a keyed hash that changes every day.
• The names and addresses you look up are not part of our routine server logs.
• Operational logs are deleted after 14 days or sooner.
• The password generator runs in your browser, so what it makes never reaches us or Google. Analytics only learns the settings you chose, such as the length. The subnet calculator and the converters send what you type to our server to work out the answer. It is not written to our logs, and it is kept only in memory, for at most a day, so a repeated calculation is quick.

What we log

To keep the service running and stop abuse, our servers write one short log line per request. It contains:

• the time, the HTTP method and the name of the page or route (for example /api/v1/tools/:id), never the full address with its query string;
• the HTTP status and how long the request took;
• a coarse browser family worked out from the User-Agent, such as chrome, safari, curl or bot, and never the full string;
• a random request ID, so we can find the line if you quote the reference from an error page;
• a client key: a truncated keyed hash (HMAC) of your network address, made with a secret that changes every day. It lets us see that a burst of requests came from one place without knowing where. We can't turn it back into your IP address, and keys from different days can't be linked.

Query strings are not logged. If something breaks unexpectedly on our side, we also log the technical error, which says which tool failed and why. Those lines can occasionally mention what was being looked up, and any IP addresses inside them are masked.

Separately, our rate limiter counts requests per network address (an IPv4 address, or an IPv6 /64 block) in memory only. Those counts are never written to disk or to the logs, and they disappear when the server restarts.

What we do not do

• We do not sell or rent your data, and we do not build advertising profiles. Our Google Analytics tag switches off Google signals and ad personalisation, so what it collects is not used for advertising.
• We do not register, reserve or trade in the domain names you search for, and we do not hand them to registrars. The one exception is a link you choose to click: a register button opens that registrar's own search page for the name. We do count that click in Google Analytics, with the registrar's name.
• We do not store passwords, and no password ever reaches our analytics. The generator creates them in your browser. If you call the password tool through the API, the response is not cached or logged.
• We do not use browser fingerprinting, advertising pixels or cross-site identifiers of our own. The only identifiers on this site are the two Google Analytics cookies described below.

Who sees your lookups

To answer a lookup we ask other servers. A domain WHOIS query reaches the registry's RDAP or WHOIS server, an IP query reaches a regional internet registry, a DNS query reaches resolvers and the domain's nameservers, and an HTTP or SSL check connects to the site you entered. Those operators see the name or address you asked about, and they see it coming from LookupOwl's servers, not from your device. Their own policies apply to their logs.

Three tools work a little differently. The blocklist checker sends the IP address or domain you enter, and the IP addresses of a domain's mail servers, as DNS queries to the operators of the blocklists it uses (for example Spamhaus and SpamCop), who can see those names and addresses. The IP location tool and the "who hosts this site" tool read a database that sits on our own server, so nothing about your lookup is sent to DB-IP or to any other location service. The security headers checker fetches the address you enter from our servers, the same way the HTTP headers checker does, and the site you enter sees that request. The domain report runs several of these tools together, so it contacts the same kinds of servers, for the one domain you enter.

To keep repeat lookups quick and gentle on those servers, we hold recent results in memory for a limited time that depends on the tool. They are stored by the lookup itself, not by who asked. The tool that shows your own IP address reads the address your request came from, shows it back to you, and doesn't cache or log it.

On the website, Google Analytics also sees what you look up, together with the name of the tool. The Google Analytics section below says exactly what it is sent. Calls made through the API or the MCP server do not go to Google Analytics.

Our content delivery network (currently Cloudflare) sits in front of the site, as with most websites, and necessarily handles your requests, including your IP address, under its own privacy terms.

Cookies and storage

LookupOwl's own server sets no cookies. Your browser may keep a few small preferences for the site, such as your light or dark choice. They stay on your device and are not sent to us. Google Analytics sets two cookies of its own on this site, described in the next section, and there is no cookie banner. Our CDN may set its own security cookies, under its own terms.

To watch capacity and reliability we also keep first-party counters on our own server: how many calls each tool gets, through which surface (web, REST or MCP), with which outcome and cache result. The counters hold totals only and carry no client information.

Google Analytics

We use Google Analytics 4 on the website to learn how it is used: which pages and tools are popular, which top-level domains people look up and what goes wrong. Google processes the data for us under its own terms. It is loaded only on web pages. API and MCP calls are not sent to it.

Each page view and each tool run sends Google a small event. This is what our events carry:

• Page views: the page address, which includes what you looked up (for example ?q=example.com), the page title and the page you came from.
• Tool runs: which tool, its category, whether it worked (or the error code), whether the answer came from the cache, how long it took, a one-word verdict such as positive or warning, and what you looked up: the domain, IP address, AS number or other value you entered, with its top-level domain. A web address is reduced to its website, and an email address to its domain. A value the tool turned down as invalid input is not reported.
• The password generator: only your settings, which are the type, the length, how many values and which character classes. Never a generated password, and never the exclude-characters or separator boxes.
• Small actions: that you copied something and which button it was (never the text), that you opened the search palette and where it sent you (the kind of thing you typed and the tool, never your words), that you changed the theme, and that you clicked a register link (the registrar, and the name you were checking).

Google adds what any website visit reveals: your browser, operating system and device type, screen size, language, and an approximate location worked out from your IP address. It also records its own automatic events, such as the start of a visit and how long a page was in the foreground. Google says it does not log or store IP addresses in Google Analytics 4. We do not combine this data with anything else, and we do not use it to identify anyone.

Google Analytics sets two first-party cookies, _ga and one named _ga_ followed by our property ID. They hold a random number that tells a returning browser apart from a new one, and they last up to two years. Event data stays in Google Analytics for up to 14 months and is then deleted by Google. See Google's privacy policy for how Google handles it.

You can opt out. Install the Google Analytics Opt-out Browser Add-on, or block googletagmanager.com in your browser or ad blocker. LookupOwl works the same either way.

Shared links and public data

Result pages have a shareable link that contains your query, for example a domain name. Anyone you send it to will see the same lookup, so keep anything confidential out of a lookup, and think twice before sharing links to results about private networks or accounts. Result pages are marked so that search engines do not index them.

Domain registration data is public information published by registries and registrars. Where personal data is shown, it is because the registry or registrar chose to publish it. Contact them to have it changed.

Your rights and contact

Because we keep no accounts and no readable personal identifiers on our own servers, there is usually nothing there to access, correct or delete. Analytics data sits in Google Analytics, described above. If you believe we hold information about you, or you want to use your rights under data-protection law such as the GDPR, contact us using the details in /.well-known/security.txt. We will reply within a reasonable time.

LookupOwl is not directed at children under 13. We may update this policy. The date at the top shows the latest revision, and we will note significant changes on this page.