Who is responsible
The controller of personal data processed through this website is the operator of ZIPCodeLookup.io [To be provided by the site operator: legal name]. [To be provided by the site operator: postal address for privacy requests] Use the contact form.
This policy describes how the site actually works. It has not been reviewed by a lawyer, and it does not claim certification or compliance with any particular law beyond describing our practices accurately.
What we collect
Server logs
Like almost every website, our web server records each request: IP address, date and time, the page or file requested, the response status and size, the referring page and your browser's user-agent string. These logs are used to keep the site running, investigate errors and defend against abuse. Log archives are deleted automatically after 10 days.
Contact form messages
When you use the contact form we store your name, email address, chosen subject, message, the time it was sent and a one-way hash of your IP address (used for rate limiting). We use this only to read and reply to your message and to keep a record of correspondence.
Your cookie choice
If you use the cookie banner, your choice is stored in a first-party cookie on your device so we can respect it. See the cookie policy.
What stays in your browser
The ZIP search, radius, distance, bulk lookup, validator and random tools download a public reference file and do all the work on your device. What you type into them is not sent to our server.
The What is my ZIP code? tool asks your browser for your location only after you press the button, and only if you allow it. The coordinates are compared with the reference file on your device and are never transmitted to us or stored.
Why we process it (legal bases)
- Server logs: our legitimate interest in operating a secure, working website.
- Contact messages: your consent, given with the checkbox on the form, and our legitimate interest in answering enquiries. You can withdraw consent at any time; this does not affect replies already sent.
- Consent cookie: it is strictly necessary to remember the choice you made.
Where data is stored and who processes it
The site and the data above are stored on a virtual server rented from Hostinger (virtual private server), which acts as our hosting provider. Contact messages are saved in a private directory on that server that is not reachable from the web. Messages are not sold, shared for marketing or passed to anyone else, except where the law requires it.
We do not use analytics services, advertising networks, social media plugins, embedded videos, third-party fonts or content delivery networks. Fonts and scripts are served from our own domain.
Links to other websites
Pages link to services such as USPS, the Census Bureau, HUD and OpenStreetMap. Those links open the other site only when you choose them; nothing is loaded from them in advance. Once you follow a link, the other site's privacy policy applies.
How long we keep it
| Data | Retention |
|---|---|
| Server log archives | 10 days |
| Contact form messages | Up to 6 months, then deleted automatically |
| Rate-limit records (hashed IP) | 24 hours |
| Consent cookie | 180 days on your device, or until you clear it |
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its use, receive a copy in a portable format, and withdraw consent. To make a request, use the contact form and choose “Privacy or data request”; include the email address you used so we can find your message. We may ask you to confirm that the address is yours before acting.
You also have the right to complain to your local data protection authority.
Children
The site is a general reference tool and is not directed at children. We do not knowingly collect personal data from children through the contact form.
Security
The site is served only over HTTPS with a strict content security policy. The contact endpoint checks the origin of each submission, validates every field and limits repeated submissions. Stored messages are readable only by the server account that runs the site.
Changes to this policy
If the way the site handles data changes (for example, if analytics were ever added) this policy and the cookie policy will be updated first, the date at the top will change, and any non-essential cookies would require your consent through the cookie banner.