Privacy
In short: no cookies, no tracking, no ads, no telemetry. The program only talks to the servers you check – and once to us when activating. All the details are here.
1. Controller
HMF-IT UG (haftungsbeschränkt), Parkstr. 31, 49080 Osnabrück
E-mail: support@hmf-it.de · further details in the legal notice.
No data protection officer has been appointed as there is no legal obligation.
2. The essentials at a glance
- During a normal visit this website sets no cookies, uses no analytics or tracking services and stores no server log files.
- Fonts, images and scripts are hosted on our own server. During your visit no data is transmitted to third parties. The only exception is the purchase page, where PayPal is embedded (section 6).
- We process personal data only when you write to us or buy IPX.
- The IPX program has no telemetry and no user account. History, favourites and settings are stored only on your PC (section 9).
3. Hosting, no server log files
We operate the server of this website ourselves (HMF-IT UG (haftungsbeschränkt), Parkstr. 31, 49080 Osnabrück, Germany). For a page to reach you, your browser must technically transmit your IP address to the server. It is processed only for the duration of the connection. The server stores no access logs. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in delivering the website).
4. Local storage (theme, font size, motion, language)
If you choose light or dark yourself, a larger font, “Reduce motion” or a language, we store this choice in your browser's local storage (localStorage: ipx-theme, ipx-size, ipx-motion, ipx-lang). These entries never leave your device and serve only the display you requested. No consent is required for this (§ 25 (2) no. 2 TDDDG). You can delete them at any time via your browser settings.
5. Contact form and withdrawal
If you write to us via the form or by e-mail, we process your details (e-mail address, optionally name, topic, message) to answer your request. The legal basis is Art. 6 (1) (b) GDPR if it concerns a purchase or contract, otherwise Art. 6 (1) (f) GDPR.
To protect against spam we use an invisible form field and a time check. To limit mass requests, a non-reversible hash of your IP address is stored for at most one hour. We do not use external captcha services.
Messages are additionally stored in our password-protected admin area so that no request gets lost. We delete them as soon as they are dealt with and no retention obligations apply.
Withdrawal form: if you declare a withdrawal via “Withdraw from contract”, we process name, e-mail address, order details, optionally purchase date and remark as well as the time of receipt, and we send you an acknowledgement of receipt. The legal basis is Art. 6 (1) (c) GDPR (legal obligation) and (b) (performance of the contract).
6. Purchase and payment with PayPal
Contracting party when buying IPX is us, HMF-IT UG. For the order we process: chosen edition, price, order number, time of your consent to immediate delivery, licence key and the data we receive from PayPal (name, e-mail address, country, transaction number). The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and (c) (tax and commercial retention obligations, usually 8 to 10 years for invoices and accounting records).
Payment: payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. On the “Buy” page we load PayPal's payment buttons for this. Your IP address and device data are technically transmitted to PayPal; PayPal may use its own cookies or similar techniques for fraud prevention. The other pages of this website do not embed PayPal. When you click a PayPal button, you enter your payment details directly at PayPal; we receive no bank or card data. PayPal processes this data on its own responsibility, for certain payment methods (e.g. direct debit) possibly with a credit check. The legal basis is Art. 6 (1) (b) GDPR and § 25 (2) no. 2 TDDDG. PayPal's privacy statement applies.
E-mails: after the purchase we send the order confirmation with the licence key and afterwards the invoice to the e-mail address of your PayPal account.
7. Activating the licence
When activating, the program sends the licence key, a device identifier, the name of the PC and the program version to our server. The device identifier is a non-reversible hash of the Windows installation ID; it allows no conclusions about hardware or person. For your order we store on which PCs the licence is activated and when the program last checked in. About every 30 days the program quietly asks whether the licence is still valid, for example after a refund. When a PC is released we delete the entry. The legal basis is Art. 6 (1) (b) GDPR (performance of the licence contract). The trial version transmits no data for this.
8. Downloads and update check
When you download, we count how often each file is downloaded per day and from how many different connections. For this we derive a daily identifier from your IP address, a secret value and the date which cannot be reversed, and delete it after two days at the latest. In addition our own server determines the country from the IP address without transmitting it to third parties. For each download we store the country and the truncated IP address (without the last block, e.g. 93.184.216.x) and delete these entries after 30 days; afterwards only the number of downloads per country remains. We do not store the full IP address and set no cookies. The legal basis is our legitimate interest in measuring the distribution of the program in a simple way (Art. 6 (1) (f) GDPR). Country data: IP Geolocation by DB-IP (licence CC BY 4.0).
Update check: at startup the program loads a small file with the current version number from our server. Only the IP address is transmitted technically and not stored. The check can be disabled in the settings.
9. Privacy in the IPX program
IPX is a tool that queries servers on the internet and on the local network at your request. Which data goes where depends on the tool:
- Directly to the checked systems: DNS queries go to the chosen resolver (your system's by default, optionally public resolvers such as Cloudflare, Google, Quad9 or DNS over HTTPS), WHOIS and RDAP queries to the responsible registry servers, HTTP and SSL checks to the entered website, SMTP tests to the mail server, ping and traceroute to the target. These operators see your IP address and the query; their privacy policies apply. The program sends nothing to us in the process.
- Other services used by individual tools: provider and AS data come from the Team Cymru service (via DNS), the blacklist check queries public DNSBL operators (e.g. Spamhaus), DNS propagation queries 16 public resolvers worldwide.
- “My IP”: to show your public IPv4 and IPv6 address, the program asks our server (ipv4.ipx-tool.de, ipv6.ipx-tool.de). The server answers with address, reverse name and country and stores nothing. If our server is unreachable, the program falls back to the ipify.org service.
- Stays on your PC: history, favourites, watchlist, saved Wake-on-LAN devices and settings are stored as files in your user profile (
%APPDATA%\HMF-IT\IPX). You can clear them in the settings. The tools Encoder, Hashes, JWT decoder, JSON, Timestamp, Password generator, Subnet calculator and MAC vendor work completely offline. - Clipboard: on request IPX detects when the window is activated whether the clipboard contains a domain or IP and offers it. The content is only read, not stored or sent; the feature can be turned off.
- Reports (HTML, PDF, text, JSON) are generated locally; they contain the input and the results. Review them before passing them on.
10. Admin area
For our own password-protected admin area we set a technically necessary session cookie. Visitors of the website are not affected.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). An informal e-mail to support@hmf-it.de is sufficient.
You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
12. Encryption
This website is fully encrypted via TLS (HTTPS). The licence server and “My IP” are also only reachable encrypted.