Privacy policy
1. Who we are
The service operator is the owner of the UDPcheck project (“we”). Contact for any questions about data: draldrean@protonmail.com. The service is non-commercial and has no advertising or analytics.
2. What the service does and why it needs data
The service checks whether UDP traffic passes between your device and our servers in your country and abroad, and shows which provider blocks traffic and in which direction. For the check to work, the servers must know which address you contact them from: otherwise they have nothing to reply to and cannot build a route to you. We collect nothing beyond what is needed for that.
3. What data and for how long
| What | Why | Where and how long |
|---|---|---|
| IP address | to identify the network (provider), reply to test packets, build a route, limit the request rate | only in the server's memory, for minutes. It is not written to the database or to logs. The web server keeps no access logs |
| Check result: network number (ASN), provider name, country, how many replies came from which servers, time | statistics per provider, provider pages, the change journal | in the database, 60 days |
| Random browser number | rate limits, so that one browser is not counted in the statistics more than once an hour; counting how many different browsers visit per day (see below) | created by the page and stored in your browser (localStorage, key udpc_cid); the database holds only its hash (SHA-256, 16 characters), for 60 days. It is not linked to you and does not collect device data |
| Anonymous visit statistics | to understand how many people use the site and whether the server copes | numbers per day only: how many times the page was loaded, how many different browsers, how many times “Check” was pressed, how many requests the server rejected or could not serve. Different browsers are counted by a hash of “date + random number”: the hash itself is never written to disk, only the number remains. Addresses, headers and pages are not recorded. Kept for up to a year |
| Intermediate route hops | to show you the route and the places where it breaks | hop addresses only in memory and in your page; the database gets only the numbers of the networks along the path |
| Data in your browser | to show the last route without asking again | localStorage (udpc_trace, up to 6 hours), a mark that the notice was closed (udpc_notice) and the chosen language (udpc_lang); cleared together with the site data |
| Nodes and volunteer servers (if you install them) | operation of the check network | callsign, network, country, approximate city, type of system, key hash; for a volunteer server also its IP (not shown publicly) while it takes part |
Database backups are encrypted and kept for up to 14 days; they hold the same set as the database itself: visitors' IPs are not there, volunteer servers' IPs are.
There are two exceptions to “IP is not written to logs”. First: the servers' system log records the addresses from which someone tries to guess a login over SSH (this is administrator login, not the site). Second: if a request to the site clearly looks like an attack (probing for service files such as .env, typical WordPress and phpMyAdmin addresses, SQL injection), the sender's address and the request itself are written to the log. Ordinary visitors never request such addresses. Whoever does it three times within ten minutes is blocked for a day or longer. These records are kept for up to 30 days and are used only to block bots and scanners automatically. Addresses of other site visitors and of checks do not get there; rate counters live in memory and disappear on restart.
4. What we do not do
- we use no cookies, counters, advertising, third-party scripts or fonts;
- we do not sell or pass data to third parties;
- we do not try to find out who you are;
- we do not send your IP to third-party geolocation services: the geolocation databases are kept by us; network names are requested from RIPEstat and PeeringDB by network number only.
5. Who sees your IP
- our hub (the site's server) and the project's anchor servers, which need to reply to you and build a route. They are in different countries, including outside yours, because foreign UDP cannot be checked otherwise;
- up to two checked volunteer servers per browser check: your browser sends them short UDP packets (STUN), so their owners can technically see the address;
- your provider and intermediate networks see the traffic itself just as they see any other traffic.
6. Basis and your consent
By pressing “Check my network” you ask the service to run a check and agree to data processing to the extent described; it is also our legitimate interest in operating the service. If you do not agree, do not press the button: the statistics pages can be read, your IP is also visible to the server for the duration of the request, but it is stored nowhere. You can withdraw consent at any time: clear the site data in your browser and do not run the check.
7. Your rights
You have the right to learn what data about you exists, to demand its correction or deletion, and to object to processing. Because we do not identify you,
records of a specific person cannot be found by name or address, and so they cannot be provided or deleted. If you want your browser's records removed,
send us the value of udpc_cid from your browser storage (on the page: F12 → Application / Storage → Local Storage → udpc_cid) and we will delete the related records.
If you are in the European Union or the United Kingdom, you can also contact your data protection supervisory authority.
8. Security
Connections use HTTPS, servers are accessible by keys only, backups are encrypted, and the source code is open, so how the service works can be checked (privacy principles). The service is not intended for children.
9. Changes
When the policy changes we publish a new revision with the date at the top of the page. Earlier revisions are kept in the repository history.