IPThing shows you details of the HTTP connection you made to this service (IP address, headers, TLS, and related metadata). That is the product.
When a database is configured, each inspected request may be recorded for operations, abuse investigation, and aggregate analysis. Typical fields include client IP and geolocation cache, method, path, query parameters, User-Agent, Referer, Host, protocol, declared content length, response status code, TLS details when present, timing, response format, and a copy of request headers with secrets removed.
Request bodies are not stored (oversized bodies are rejected; only size/status metadata may be recorded).
Sensitive header values are redacted before persistence, including Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-Api-Key, and X-Auth-Token (stored as [redacted]).
Request and related records are retained indefinitely unless the operator deletes them manually.
A separate project publishes aggregate-only charts and narrative from this data at stats.ipthing.net. Source: jonhadfield/ipthing-analysis. That report does not publish raw headers or individual client identifiers.
Processing is for providing the inspection service you requested, securing and operating the service, and understanding usage patterns. If you are in the EEA/UK and have questions about personal data held about your visits, contact the service operator.