The data controller responsible for the processing of personal data collected through this website is:
We do not have a designated Data Protection Officer (DPO) as we do not meet the thresholds under Art. 37 GDPR that require mandatory appointment. All data protection enquiries should be directed to the privacy contact above.
This Privacy Policy applies to all users of the website snoopmy.com and all its subpages and language variants (collectively, the "Service"), regardless of their country of residence or nationality.
This Policy is designed to comply with the following legal frameworks, among others:
| Data type | How detected | Sent to third party? | Stored on our servers? |
|---|---|---|---|
| Public IP address | Sent automatically by your browser with every web request | Yes — geolocation API (see §5) | No |
| Approximate location (country, city) | Derived from your IP address by geolocation API | Yes — geolocation API (see §5) | No |
| Browser name and version | Extracted from your browser's User-Agent string | No — processed locally in your browser | No |
| Operating system | Extracted from your browser's User-Agent string | No — processed locally in your browser | No |
| Device type | Detected via JavaScript in your browser | No — processed locally in your browser | No |
| Screen resolution and pixel ratio | Detected via JavaScript in your browser | No — processed locally in your browser | No |
| Timezone | Detected via JavaScript (Intl API) in your browser | No — processed locally in your browser | No |
| Browser language | Detected via JavaScript (navigator.language) in your browser | No — processed locally in your browser | No |
| Battery level | Detected via JavaScript (Battery Status API) in your browser | No — processed locally in your browser | No |
| Connection type | Detected via JavaScript (Network Information API) in your browser | No — processed locally in your browser | No |
| VPN/proxy status | Derived from IP metadata returned by geolocation API | Yes — geolocation API (see §5) | No |
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| IP address (transmitted to geolocation API) | To provide the IP lookup and geolocation features that are the core purpose of the Service | Legitimate interest (Art. 6(1)(f)) — the user visits SnoopMy specifically to see this information | Not stored by us; see third-party API policies (§5) |
| Server access logs (IP address, timestamp, URL, User-Agent, HTTP status) | Security, abuse prevention, server diagnostics | Legitimate interest (Art. 6(1)(f)) | 14 days, then automatically deleted |
| Cookie consent record | To record and demonstrate your consent choices as required by law | Legal obligation (Art. 6(1)(c)) | 13 months |
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Usage data (pages visited, session duration, referrer, device type, country) | Analytics via Google Analytics 4 to understand how the Service is used and improve it | Consent (Art. 6(1)(a)) | 14 months (GA4 default) |
| Advertising identifiers and browsing behaviour | Personalised advertising via Google AdSense | Consent (Art. 6(1)(a)) | Up to 13 months (Google policy) |
To provide the IP address lookup and geolocation features, your browser makes a direct request to a third-party API service. This request necessarily includes your IP address. We use the following services:
These API calls are made client-side (from your browser) and are not proxied through our servers. We do not receive or store the data returned by these APIs — it is displayed directly in your browser and discarded when you leave the page.
If you do not wish your IP address to be sent to these third-party APIs, you should not use the IP address, location, or VPN detection features of SnoopMy. All other features (browser, OS, device, screen, timezone, language, battery, connection) process data entirely within your browser without any external API calls.
With your consent, we use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
GA4 uses cookies to collect information about how visitors use the Service, including pages visited, time spent, referral source, device type, browser, and approximate geographic location (country/city). This data is aggregated and anonymised for our reporting purposes.
We have implemented the following privacy settings in GA4:
Google LLC is certified under the EU-US Data Privacy Framework. Data transfers to the USA are therefore covered by an adequacy decision (Commission Implementing Decision (EU) 2023/1795). Additional safeguards include Standard Contractual Clauses (SCCs).
You may opt out of Google Analytics at any time by:
Google's Privacy Policy: policies.google.com/privacy
With your consent, we use Google AdSense, an advertising service provided by Google LLC. Google AdSense uses cookies and similar technologies to serve personalised advertisements based on your prior visits to this website and other websites.
AdSense cookies are loaded only after you have given your explicit consent to Advertising cookies in our cookie banner. If you decline advertising cookies, non-personalised ads may still be shown based on contextual content only.
You may opt out of personalised advertising at any time via:
The Service is hosted on servers provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes server access logs on our behalf as a data processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. The servers are located in the European Union (Falkenstein, Germany).
Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) provides DNS, CDN, and DDoS protection services. Cloudflare may process your IP address as part of its network operations. Cloudflare is certified under the EU-US Data Privacy Framework. For more information: cloudflare.com/privacypolicy/
We do not sell your personal data to any third party. We share personal data only in the following circumstances:
Our primary servers are located in the EU (Germany). However, some of our third-party service providers are based outside the EU/EEA, in particular in the United States. Where personal data is transferred outside the EU/EEA, we ensure that appropriate safeguards are in place:
For UK users: transfers to non-adequate countries are covered by UK International Data Transfer Agreements (IDTAs) or UK Addenda to SCCs where applicable.
For Swiss users: transfers comply with the requirements of the revFADP and its implementing ordinances.
We implement appropriate technical and organisational measures (TOMs) to protect personal data against unauthorised access, alteration, disclosure, or destruction, including:
No method of internet transmission is 100% secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.
| Data | Retention period | Reason |
|---|---|---|
| Server access logs | 14 days | Security and abuse prevention; automatically deleted thereafter |
| Cookie consent record | 13 months | Legal compliance; renewed on each consent update |
| Google Analytics data | 14 months | GA4 default retention; only if Analytics consent given |
| Google AdSense data | Up to 13 months | Google policy; only if Advertising consent given |
| IP address / geolocation (via API) | Not stored by us | Displayed in real time and discarded; see API provider policies |
UK users have equivalent rights under the UK GDPR and Data Protection Act 2018. Complaints may be filed with the Information Commissioner's Office (ICO).
Swiss users have the right of access, rectification, erasure, restriction, and portability under the revFADP. Complaints may be filed with the Federal Data Protection and Information Commissioner (FDPIC).
California residents have the following rights under the CCPA/CPRA:
To exercise your California rights, contact us at [email protected]. We will respond within 45 days as required by law. If necessary, we may extend this period by a further 45 days (90 days total) with prior notice to you, as permitted by the CPRA. We may need to verify your identity before processing your request.
Categories of personal information collected in the preceding 12 months: Identifiers (IP address); Internet or other electronic network activity information (browsing data via Google Analytics, with consent); Geolocation data (approximate location from IP address).
Categories of sources: Directly from your device and browser; third-party geolocation APIs.
Business or commercial purpose for collection: To provide the Service; security; analytics (with consent); advertising (with consent).
Categories of third parties with whom we share personal information: Google LLC (analytics and advertising, with consent); geolocation API providers (to provide core Service); hosting provider (Hetzner); CDN provider (Cloudflare).
Brazilian users have rights equivalent to those listed above under GDPR, including the right to confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing, and the right to revoke consent. The legal bases for processing under the LGPD are legitimate interest (Art. 7(IX)) for the core Service, and consent (Art. 7(I)) for analytics and advertising. To exercise your rights, contact [email protected].
Canadian users have the right to access their personal information and to challenge its accuracy. We collect personal information only for the purposes identified in this Policy and with your knowledge and consent (or as permitted by law). To exercise your rights or file a complaint, contact [email protected] or the Office of the Privacy Commissioner of Canada.
Australian users have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You have the right to access and correct personal information we hold about you, and to complain about a breach of the APPs to the Office of the Australian Information Commissioner (OAIC).
South African users have rights under the Protection of Personal Information Act 4 of 2013, including the right to access, correction, deletion, and objection. Complaints may be filed with the Information Regulator of South Africa.
Japanese users have rights under the Act on the Protection of Personal Information, including the right to disclosure, correction, deletion, and suspension of use. To exercise your rights, contact [email protected].
South Korean users have rights under the Personal Information Protection Act, including the right to access, correction, deletion, and suspension of processing. To exercise your rights, contact [email protected].
Indian users have rights under the Digital Personal Data Protection Act 2023, including the right to access information, correction, erasure, and grievance redressal. To exercise your rights, contact [email protected].
To exercise any of the rights listed above, please contact us at [email protected]. We will respond within the timeframe required by the applicable law (30 days under GDPR, 45 days under CCPA, etc.). We may need to verify your identity before processing your request. There is no fee for exercising your rights unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request as permitted by law.
We use cookies and similar technologies on this website. Full details of the cookies we use, their purposes, and how to manage them are set out in our Cookie Policy.
The Service is not directed at children under the age of 13 (or a higher age if required by local law — for example, 16 in certain EU member states, 14 in Spain and Italy for digital consent purposes). We do not knowingly collect personal data from children below the applicable age of digital consent. If you believe that a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal data.
Some browsers support a "Do Not Track" (DNT) signal. As there is currently no universally accepted standard for responding to DNT signals, we do not alter our data collection practices based on DNT signals. However, you can control data collection through our cookie consent banner.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes, we may also provide additional notice. Your continued use of the Service after any changes constitutes acceptance of the updated Policy.
Previous versions of this Policy are available upon request by contacting [email protected].
This Privacy Policy is governed by the laws of Italy, without prejudice to any mandatory provisions of the law of the country of residence of EU/EEA consumers, including mandatory consumer and data protection rights. For EU/EEA users, this Policy is also governed by the GDPR, which takes precedence over conflicting national law. For users in other jurisdictions, the applicable local privacy law also applies to the extent required.
For any privacy-related questions, requests, or complaints, please contact:
We aim to respond to all privacy enquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority for your country (see §13 above).