Data processed during a scan
Browser fingerprint and score calculations run in your browser. The displayed signal list is not uploaded as a score profile. Like any web server, the service necessarily receives your IP address, request time, requested URL, user agent and language headers when responding to requests.
The IP information feature uses an approximate network and geographic lookup. It does not request GPS, Wi-Fi positioning or precise device location. Approximate country, region, city, ASN, ISP and proxy or hosting classifications may be returned to your browser.
DNS and WebRTC tests
A DNS test creates a random test identifier and records which recursive resolver IP addresses query the generated hostnames. Active sessions expire automatically, normally within ten minutes. These records exist only to return the resolver list for that test.
WebRTC checks contact public STUN services from your browser. Those services can observe your connecting IP under their own policies. vpnleak receives public WebRTC addresses only when the browser sends them to the site backend for local IP information lookup.
Third-party services
Network probes may contact Cloudflare trace, country.is, ipwho.is, ip-api.com, proxycheck.io, public STUN servers, and small Google, YouTube or Baidu resources used for connectivity comparison. Their availability and privacy practices are outside vpnleak's control. Use browser or network controls if you do not want to contact those services.
If Google advertising is enabled, Google and its partners may place or read cookies, use web beacons, IP addresses or other identifiers, and process data to serve and measure ads. Google's explanation is available at https://policies.google.com/technologies/partner-sites. Advertising is not enabled merely by publishing an ownership meta tag or ads.txt record.
Cookies, consent and retention
vpnleak does not need a first-party account cookie for the scan. Before personalized Google ads are served to users in regions that require consent, the site must activate an appropriate Google-certified consent management platform and offer the required choices.
Temporary DNS session data expires automatically. Infrastructure logs may be retained for a limited period for security, abuse prevention and reliability. The service does not provide an account form for submitting personal information.