Privacy Policy

VPS Observatory is a private research project run by an individual. The project is not a legal entity and determines the purposes and means of processing on its own, i.e. it acts as the data controller.

For any questions about data: the contact form.

• we do not sell or rent personal data;
• we do not use Google Analytics, social network pixels or any third-party ad networks;
• we do not track you across other sites and do not build advertising profiles;
• we do not require registration and do not collect visitors’ contact details;
• we never publish full IP addresses — neither yours nor those of tested servers.

We use only strictly necessary cookies: a session identifier and a CSRF token, both with a 2-hour lifetime. There are no advertising or tracking cookies.

Our visit statistics use no cookies at all — they work server-side. Declining cookies will therefore not break the site or change what the statistics contain. Details are in the Cookie Policy.

If you give us access to a server to run a test:

• credentials are stored encrypted and used solely to run the measurement;
• once the job finishes they are irreversibly deleted;
• the agent measures performance and collects system facts (CPU model, kernel, virtualization type). It does not read or copy your files or database contents;
• the full IP of a tested server is never published — only its hash is stored with the results, while the provider, city and ASN are shown publicly.

We strongly recommend giving access only to servers without third-party or sensitive data, and revoking access after the test.

The site and database themselves are located in the Netherlands (EU). Cloudflare, however, is a global network, and some IP-lookup services are located in the USA. In those cases transfers rely on Standard Contractual Clauses (SCC), which these companies apply by default.

• Server credentials (SSH) — deleted immediately after the test finishes.
• Web server logs — removed automatically by rotation.
• Visit and outbound-click statistics — stored pseudonymized and purged periodically; we only need them in aggregate.
• Reviews — kept while published on the site, or until you request removal.
• Measurement results — kept indefinitely: this is research data and its historical value is the whole point. It contains no personal data.

If you are in the EEA or the UK, you have rights under the GDPR. We honour them regardless of your country:

• Access — find out what data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted (“right to be forgotten”).
• Restriction — have processing temporarily suspended.
• Objection — object to processing based on legitimate interest, including statistics.
• Portability — receive your data in a machine-readable format.
• Complaint — lodge a complaint with the data protection authority in your country.

To exercise a right, write to the address below. We respond within 30 days. Note: since we keep no accounts, we may need your IP address and approximate visit time to locate your data — otherwise we physically cannot identify you.

The site works over HTTPS only. Server credentials are encrypted, IP addresses in reviews are stored as an irreversible hash, and the admin area is behind authentication and excluded from indexing.

No protection is absolute, but we apply reasonable technical measures and do not store what we do not need.

The Service is intended for technical professionals and is not directed at children under 16. We do not knowingly collect children’s data.

We update this policy when the data we collect or the tools we use change. The current version is always here, with the update date at the top of the page.

For any data questions and to exercise your rights: the contact form