Privacy Policy

When you enter an IP address, the application processes that address to return location, network, fraud-risk, and health context. IP addresses can be sensitive because they may reveal approximate network location and provider information.

Avoid entering IP addresses or logs that you are not authorized to investigate. Do not use the tool as the only basis for legal, employment, or high-stakes decisions.

Nothing, by design. Crafzo has no database and no account system: a lookup is answered live and the result exists only in your browser. The site does not keep a history of the addresses you check. The hosting platform (Vercel) keeps ordinary request logs for a short period for operations and abuse prevention, as any web host does.

A result page has a shareable address of the form /?ip=… . If you use Share or copy that link, the looked-up IP address is part of the link you send, and the recipient's browser and any intermediate service will see it.

Each lookup sends the address you entered to the following providers, from Crafzo's server, so they can return the requested fields. Nothing else about you (your own IP, browser or account) is sent with it.

ip-api.com receives the address and returns country, region, city, coordinates, time zone, ISP, organization, ASN and its hosting, mobile and proxy flags. If ip-api does not answer, the address is looked up in a MaxMind GeoLite2 database bundled with the site (built 2025-06-03); that lookup happens on Crafzo's server and nothing is sent to MaxMind.

Scamalytics receives the address and returns the 0-100 fraud score, its risk band, and VPN, Tor, datacenter, blacklist and bot signals drawn from its own data and the open-source lists it aggregates (FireHOL, IP2Proxy LITE, x4bnet). Scamalytics states that it does not log API calls or store the addresses submitted to it.

NVIDIA's NIM API receives the address together with the score and signals above and returns the optional Intelligence summary. When that service does not respond, the panel shows a summary written from the provider fields instead.

When you check your own address, your browser first asks ipify (api.ipify.org / api64.ipify.org) or icanhazip.com what your public IPv4 and IPv6 addresses are. Those services see your address the way any website you visit does; they return it and nothing more.

The site loads Microsoft Clarity for usage analytics (page interactions and anonymised session replays). Text you type into the lookup field is masked by Clarity's default input masking, and the whole result area is additionally marked with Clarity's mask attribute, so looked-up addresses and their details are not readable in recordings. Clarity does receive the page URL, which contains the looked-up address when a result was opened from a shared link. Google AdSense is loaded only after you interact with the page and may set advertising cookies; both services are governed by Microsoft's and Google's privacy terms, and neither is required for a lookup to work.

Use IP intelligence only for a clear purpose, such as troubleshooting, security review, fraud prevention, or abuse triage.

For product analytics or long-term reporting, consider aggregation or retention limits instead of storing exact IP addresses forever.