Yes: IPGeolocation.io stores the IP addresses you look up, but only in standard API access logs, and only for 14 days. Every API request is written to one log line that includes the IP address you asked about. We keep these logs for security, troubleshooting, and abuse prevention, then delete them automatically. For billing, we keep only request and credit counts, never the addresses.
Nothing else about your lookups stays with us. We don't use them to improve our data, we don't share or sell them, and we keep no other copy of the logs. If your rules don't allow IP addresses to leave your systems at all, our downloadable databases run the same lookups on your own servers.
What IPGeolocation.io keeps, for how long, and why
IPGeolocation.io's data retention comes down to two records from each API request: a short-lived access log and a running count for billing. Here is how a single lookup moves through them.
| Record | What It Holds | How Long We Keep It | Why It Exists |
|---|---|---|---|
| API access log | One line per request, including the IP address you looked up | 14 days, then deleted automatically (sooner if you ask) | Security, troubleshooting, abuse prevention, and reviewing your own usage on request |
| Billing counts | Request and credit totals for your account, with no IP addresses | Up to one year, then deleted | Billing and your usage history |
The IP addresses in a bulk lookup never reach the access log, because the list travels in the request body, which isn't logged. And there's no third record: we keep no backup or other copy of the access logs, and the network layer in front of the API keeps no request logs of its own. If your application caches lookup results to save repeat requests, that cache is yours, and so is its retention.
What one access log line contains
One access log line holds the request exactly as your application sent it, plus a few details about how our server answered. Here is an example line. The addresses come from documentation ranges, and the key is a placeholder.
203.0.113.10 - - [30/Oct/2026:08:03:04 +0000] "GET /v3/ipgeo?apiKey=YOUR_API_KEY&ip=8.8.8.8&output=json HTTP/1.1" 200 3245 0.312 "0.000" "0.312" "0.312" "-" "ipgeolocation-javascript-sdk/3.0.0"
Reading it from left to right:
| Part Of The Line | Example Value | What It Is |
|---|---|---|
| Caller address | 203.0.113.10 |
The server or browser that sent the request |
| Time | 30/Oct/2026:08:03:04 +0000 |
When the request arrived, in UTC |
| Request line | GET /v3/ipgeo?apiKey=...&ip=8.8.8.8&output=json |
The endpoint and every query parameter you sent |
| Status and size | 200 3245 |
The HTTP status and the response size in bytes |
| Timings | 0.312 "0.000" "0.312" "0.312" |
Total request time, then the time our upstream server took to connect, send headers, and finish the response, in seconds |
| Referrer and user agent | "-" "ipgeolocation-javascript-sdk/3.0.0" |
The page that made the call, if any, and the client that sent it |
Two addresses can appear in a line. The caller address is whatever connected to us: your server, or, when you call the API from the browser, your visitor's browser. The IP you looked up sits in the request line, because it travels as the ip parameter. The request line also holds the API key you passed as apiKey, so access to the log servers is limited to authorized members of our team. Requests authenticated with Request Origin carry no key, so no key is logged for them.
What we never do with the IPs you send
A common worry in security reviews is that an IP data vendor quietly keeps every lookup to profile users or enrich its own dataset. Our support team hears a version of it from customers: some assume we keep their lookups for life or mine them for information. Neither happens.
We don't use looked-up IP addresses to build or improve IPGeolocation.io data. We don't share them with any other party, and our Privacy Policy commits us never to rent or sell personally identifying information. After 14 days the log lines are gone, and the only record of your lookups left is the request count on your account.
Getting your logs, or deleting them early
Your access logs are available to you while they exist. Customers use them to trace a leaked or misused API key, find duplicate calls an integration makes by mistake, or explain a sudden jump in usage, often by reading the user agents to spot bot traffic behind a surge. On a paid plan you can request your logs for up to the last 14 days from the dashboard. On the free plan, ask through live chat or by email.
If you'd rather not wait out the 14 days, email our support team at support@ipgeolocation.io and ask for your logs to be deleted early. We reply to confirm once it's done.
Is an IP address personal data, and what's our role?
It can be. Privacy laws such as the GDPR and the CCPA can treat an IP address as personal data when it can be linked to a person, so your privacy team is right to ask what happens to the addresses you send.
Internet providers assign and reassign addresses often, and from an IP address alone IPGeolocation.io can't tell who is using it. Our data describes where an address sits on the network: its location, the network that announces it, and its risk signals. Our logs record which account asked about an address, not who the address belongs to.
For the addresses you send us, IPGeolocation.io generally acts as a processor and you are the controller, as our GDPR compliance page explains. We act as a controller only for our own website visitors and for data correction requests. Paid customers can request a data processing agreement (DPA), and our list of subprocessors shows who runs our infrastructure and where. Whether you have a lawful basis to process visitor IPs in the first place is your own decision, usually made with your privacy counsel.
How to look up IP data without sending IPs to us
API lookups send your IP addresses to IPGeolocation.io. Our downloadable databases keep every lookup inside your own systems.
The Geo Advance databases cover location, ASN, company, and abuse contact data, and the Security Pro databases add VPN, proxy, and Tor detection. Both ship as CSV and MMDB files that you host on your own servers, so no lookup leaves your network.
This is what we recommend to Enterprise customers who ask for a no-logging arrangement, and it's the route our team sees privacy-focused security teams take: an offline database on a private server runs the lookups with nothing logged on our side. If you're weighing the two models, choosing between the API and a database walks through the trade-offs.
If you stay on the API, two habits keep your own footprint small. Ask for only the fields you need with fields or excludes, and store the result you act on, such as a country code or a currency, instead of the raw IP address.
Answers for your vendor security review
These answers come from our legal pages and from the team that runs the API servers. Copy what your questionnaire needs.
| Question | IPGeolocation.io's Answer |
|---|---|
| Do you store the IP addresses we look up? | Only in standard API access logs, kept 14 days and then deleted automatically |
| Why are the logs kept? | Security, troubleshooting, abuse prevention, and reviewing a customer's own usage on request |
| Are lookups used to build or improve your data? | No |
| Are lookups shared, rented, or sold? | No |
| Are bulk request bodies logged? | No, only the request line |
| Is there any other copy of the logs? | No backups or second store, and the network layer in front of the API keeps no request logs |
| Who can read the logs? | Authorized team members only |
| Is traffic encrypted in transit? | Yes, every API endpoint is served over HTTPS on every plan, free included (API documentation) |
| Where does processing run? | On our API servers in different parts of the Americas, Europe, Asia and Australia, with each request served by the nearest one. Our list of subprocessors shows the providers in each location. |
| What is your GDPR role? | Generally a processor for customer data, with the customer as controller |
| Do you sign a DPA? | Yes, on request for paid customers |
| Can logs be deleted early? | Yes, by email to support, confirmed by reply |
| How fast do you answer data-subject requests? | Within seven days, as our GDPR compliance page states |
| Can we avoid sending IPs at all? | Yes, with the downloadable databases, which run on your own servers |
FAQ
No. IPGeolocation.io doesn't sell, rent, or share the IP addresses you look up, and doesn't use them to build its data. They sit only in standard access logs, which are deleted after 14 days.
IPGeolocation.io keeps standard API access logs, including the IP addresses in each request, for 14 days and then deletes them automatically. You can email support to delete yours sooner. Billing keeps only request and credit counts, for up to one year.
No. IPGeolocation.io's bulk endpoints take the list of IP addresses in the POST body, and only the request line is logged. The addresses in a bulk request never appear in the access logs.
Yes, if you're a paid customer. IPGeolocation.io provides a data processing agreement on request; contact our team to ask for one. Our list of subprocessors is public.
The What is my IP page, the browser extensions, and the mobile app use the same API, so their lookups follow the same 14-day log retention. The browser extension also keeps your current IP in your own browser until it changes.
Pick the delivery that fits your privacy rules
For most teams, the API with its 14-day logs is the right fit: one IPGeolocation.io call returns location, security, ASN, company, abuse contact, time zone, and user agent data. If your rules keep IP addresses in-house, run our databases on your own servers instead, and if you need a DPA, contact our team.
