Privacy

Never published

• operator names and email addresses
• exact public IP addresses
• machine hostnames and internal addresses
• operating-system usernames
• street-level locations or coordinates
• registration tokens and probe credentials
• internal administrative notes

The public API has no field for any of these. It reads through a fixed set of database functions whose result columns are the whole of what can be returned, so a field cannot begin appearing because somebody added a column somewhere.

Published about a probe

• a derived identifier such as IR-7f3a
• country
• approximate city — only where the operator enabled it
• ISP and network (ASN)
• probe type
• whether it is currently online
• how many measurements it has contributed

What is stored but not published

The platform records the address a probe connects from, because that is the only way to determine its country without trusting what the probe says about itself. It is used for geolocation and to notice when a probe's network changes. It is never returned by any public endpoint, and it is masked in logs.

Administrators reviewing a probe see a truncated form such as 203.0.113.xxx — enough to tell whether several probes share a network, not enough to identify a household.

What a probe does not see

A probe measures the targets it is assigned and nothing else. It does not read files, inspect other traffic on the network it runs on, or observe browsing activity. It cannot be given an arbitrary target, including by the person running it. How that is enforced.