POLICY VERSION · IP-SECURITY-2026-10-04

Privacy & IP-address sharing

To create an account or use authenticated spatial services, you must explicitly agree to share your IP address with Location IQ for account security and request accounting. The checkbox is never preselected. Existing account holders must accept this policy before using their session or API keys for spatial requests.

What we record

Account name and email, hashed passwords, hashed authentication tokens, consent version and time, and the IP address used to give consent. For authenticated spatial requests we record account/key IDs, endpoint template, HTTP method and status, duration, reported response size, IP address and timestamp. Configured rates may be captured to compute estimated usage charges.

Usage events do not include API keys, passwords, request bodies, query strings or the coordinates you submit. Your saved queries may contain coordinates because you choose to save them.

Background catchment jobs store the coordinates, calculation settings and result privately under your account. Completed and failed jobs are retained for up to 24 hours after completion, with daily cleanup. Payment submissions retain plan quotes, payment references and receipt files so administrators can reconcile payments; these financial records and approval history are retained separately. Receipt downloads require your session or a super-administrator session.

Optional onboarding analytics

Optional journey measurement is separate from required IP-security consent. If enabled, a random HttpOnly browser cookie lasts up to 30 days. We store its hash, a broad acquisition category, selected page/event names, timestamps, and an account ID when you register. This links consented browsing to signup and credential creation. These events do not contain coordinates, full referrers, campaign text, keys, passwords or raw IP addresses. You can disable the checkbox to remove the journey cookie and its browser linkage. Detailed journey events are retained for up to 90 days, with daily cleanup; browser linkage expires after 30 days. Account activation records are retained separately. Trial limits use protected network identifiers; sandbox limits also use your account. They reset at midnight Tanzania time. Production IP approval is unchanged.

Who can see it

Your account can view its usage totals. Authorized super-administrators can inspect users and request metadata, including IP addresses, to manage access and investigate misuse. Account activation and pricing changes are audited.

Retention and server logs

Detailed request events are retained for up to 90 days, with daily deletion after that period. Aggregate historical request counters, account records, current consent evidence and administrator action records are retained separately. Web-server access logs may record connection IP addresses and request URLs for public visitors as part of normal server operation; operational log rotation governs those logs. Backups can retain records beyond their live retention period until the backups are retired.

Your choices

If you do not consent, you can read public documentation but cannot create an account or use authenticated spatial services. Contact the platform administrator through your agreed support channel to discuss access, account deactivation or data questions. Email verification and general password reset are not currently provided.

This notice describes platform behavior. An IP address does not uniquely identify a person. Spatial estimates are not observed census values.