Privacy policy (local draft)
Incomplete local draft. Business facts and translations are not approved; this is not an effective policy.
Draft version 2026-09-04-draft-1 · Draft date Sep 4, 2026
Who operates Ping123
The operator and public contact channel have not been approved (G01). This local draft is not final notice; account email addresses are not published without permission.
Scope
This draft describes current Ping123 checks and pages, including IP risk, browser privacy, maps and latency. Legacy tools may use different flows and still require individual review. Chinese, English and Spanish share one version. External services are responsible for their own processing.
Data we process
Cloudflare processes the network address and headers of access requests. The server processes the current IP and IPs you enter; latency tests process the target IP, domain or URL and probe settings. Local checks read timezone, language and device features, and process WebRTC and DNS results in memory. Map requests involve the viewed area. Exact logs and supplier fields remain under review (G02–G04).
Why we process data
Processing supports website operation, security, IP risk and network lookups, browser checks, maps and latency tests. Basic page measurement is always active; analytics-cookie use is a separate choice. The contact-request process is not confirmed. This release adds no marketing, advertising or account purpose.
Browser checks and external requests
IP risk lookups are processed by the server. Some browser information is checked on your device; WebRTC contacts Cloudflare STUN and DNS tests contact ip-api and Surfshark DNS. The checks do not request camera or microphone access. Collected WebRTC addresses, DNS resolver addresses and fingerprint results are not sent to the Ping123 application backend or Google Analytics. External infrastructure can observe connection information; checks are not fully offline. Notice and choice for automatic external probes still require G08 review.
Cookies and local storage
ping123-locale stores the manual language preference in the browser without automatic expiry; clearing site data removes it. Analytics choices are also stored locally. The new record scheme and expiry await G06 approval; proposed periods are not approved policy. Google Analytics may use _ga / _ga_* cookies after activation is approved and consent is given; actual expiry and settings await G05 review. A local consent record is not a complete legal audit trail.
Google Analytics
Google Analytics loads on the production site to understand use of public pages. Analytics cookies are denied by default, while cookieless basic page measurements are still sent; allowing analytics cookies lets Analytics distinguish sessions. Requests involve network addresses and device information and are not fully anonymous. Checked IPs, targets, coordinates, scores, WebRTC/DNS addresses and fingerprints are not sent as analytics events. Privacy settings turn analytics cookies on or off; changing the choice does not automatically delete data already sent.
Service providers and recipients
Cloudflare provides hosting, the legacy API binding and STUN; the legacy IP service uses Cloudflare, AbuseIPDB and network data. ip-api and Surfshark DNS receive DNS probes; OpenFreeMap supplies map styles and tiles. Google Fonts CSS and font requests send connection information to Google. Globalping privacy terms are unverified; the linked source is API documentation. Globalping receives latency targets and probe settings; anyone with the result URL or ID can read results without authentication. Google Analytics is used for basic page measurement; analytics-cookie use follows the Privacy settings choice. The commercial restrictions of the anonymous ip-api API and supplier licences and retention still require business approval (G03/G04).
Retention
The check session currently exists only in browser memory and is not retained as history after a reload. Language preferences remain locally until cleared. Retention periods or criteria for Cloudflare/legacy API logs, caches, third-party probes, analytics and contact requests are not approved (G02–G06). No claim of no logging or zero-day retention is made.
International transfers
External providers and global probes may process data in different countries. Actual regions, safeguards, contracts and legal bases await G07 review. EU-only processing and signed SCCs have not been confirmed.
Your choices and rights
You can reject or withdraw optional analytics in Privacy settings and clear browser site preferences. Applicable law may provide access, correction, deletion, restriction or objection rights, but applicability, identity verification and handling procedures await G07 review. A public contact channel is not approved (G01); this draft is not an operational request channel.
Regional information
Language does not determine applicable law. EEA, UK, Swiss, US/California, Spanish and Latin American requirements need review against actual operations and audiences, including legal bases, transfer mechanisms, sale/share, GPC and opt-out processes. This release has no advertising; future ads need separate approval. The custom analytics prompt is not described as a Google-certified CMP.
Children
The intended age range and response to inappropriate collection are not confirmed. Current checks have no age-verification feature. No unverified age threshold or assurance that minors are excluded is stated.
Security and limitations
The site uses HTTPS. Check sessions stay in memory and sensitive browser-check results are not sent to the application backend. Complete network and log auditing remains pending; absolute security is not guaranteed. The map shows an approximate IP area, not a street address, and the score is not a guarantee of platform access or security.
Policy updates
The date of this version is a draft date, not an effective date. G01–G09 are unapproved; language equivalence and contact channels await final review (G09). New purposes, providers or analytics settings require an updated policy and review of whether a renewed choice is needed. Old consent must not automatically extend to new purposes.