What we collect on account holders, the analytics and cookies in use today, the third parties that see your data, and your rights over it - including the cookie notice for GA4.
This Privacy Policy was drafted by an engineering agent responding toissue #188 , by reading the actual code paths that collect, store and export account data. It is not legal advice and has not been reviewed by counsel. Two items in particular are placeholders that need a real answer, not an engineer's guess: the named privacy officer required by Quebec Law 25 (Section 9), and a formal data-retention schedule (Section 6). Do not treat this page as binding until a lawyer has reviewed it and this notice has been removed.
BGPScout is operated by Hive Data Center Inc. ("BGPScout", "we", "us"), Montreal, Quebec, Canada. This policy covers bgpscout.io - the public site, the signed-in application, the REST API and the MCP server.
Account creation is by OAuth only, through Google or PeeringDB - there is no password-based signup, so we never see or store a password. When you sign in, we store:
As you use the product, we also store what you explicitly create: API keys you generate (we store a label, creation date, last-used date and active flag - never the key material itself in reversible form), items on your watchlist, saved searches, favourite ASNs and traceroutes, watch rules, and any traceroute measurements you submit.
We do not collect payment information. There is currently no payment processor integrated with BGPScout - access is free during the current "Demo access" phase (see Terms of Service).
BGPScout uses Google Analytics 4 (measurement ID G-3QSYJ79F21) on the signed-in application. It is not present on the public marketing pages, including this one. Where it is present, it currently loads and begins tracking before you have made any cookie choice - there is no consent gate in front of it today. We are disclosing that plainly rather than describing a consent mechanism that does not exist yet; whether one is legally required before GA4 may load (Quebec Law 25 and GDPR both point toward yes for non-essential analytics) is one of the questions in Section 9 that needs counsel's answer, and a product fix, before this can be called compliant.
GA4 collects standard web-analytics data: pages viewed, general device/browser information, and an approximate location derived from IP address. Google's own handling of that data is governed byGoogle's Privacy Policy.
Cookies BGPScout sets or that are set by services embedded in the page, as of this draft:
A signed session cookie ( connect.sid, via express-session) is set when you sign in. It is required for the signed-in application to work at all and is not used for tracking. It cannot be turned off without signing out.
On signed-in pages only: Google's _ga, _ga_* and related cookies, set by the GA4 tag described in Section 3. These are not essential to the product working. As noted above, they currently load without asking first - there is no cookie-preferences control on the site today. This is a gap, and it is named here rather than hidden.
No advertising cookies were found anywhere in the codebase, and BGPScout does not run ads (see the "No Ads" line on the pricing page).
Services that can see some part of your data, found by reading the code rather than assumed:
If you sign in with Google, Google acts as your identity provider and shares your profile with us as described in Section 2. Separately, Google Analytics (Section 3) receives usage data from your signed-in sessions. Google LLC, United States.
If you sign in with PeeringDB, PeeringDB's OAuth service authenticates you and shares your PeeringDB profile with us. PeeringDB, a project of The PeeringDB Foundation.
Map tiles and geocoding on ASN, IXP and prospecting map views are served by Mapbox. Loading a map sends your browser's IP address to Mapbox's servers as an ordinary consequence of fetching map tiles. Mapbox Inc., United States.
Some scripts, styles and fonts are loaded from jsDelivr, cdnjs (Cloudflare), unpkg, code.jquery.com and Google Fonts rather than served from our own domain - the exact list allowed by the site's Content-Security-Policy. Loading a page therefore also sends your IP address to whichever of these are used on that page, as a normal side effect of fetching a file from them.
Not found anywhere in the codebase, and therefore not in use: a payment processor, an outbound email-delivery service (account registration and password reset by email are both disabled - see the Terms of Service), and any third-party error-monitoring or crash-reporting service.
The database and application are self-hosted (MariaDB and a Caddy reverse proxy, per docker-compose.yml) rather than run through a named cloud provider's managed service, and nothing in the repository states which country or facility the server physically sits in. That matters for cross-border-transfer questions under Law 25 and GDPR and needs an answer from the owner, not a guess from this page.
There is no automated data-retention or account-expiry job anywhere in the codebase. Today, data is kept for as long as your account exists, full stop - there is no "delete after N months of inactivity" mechanism, and no separately stated retention period for de-identified traceroute submissions after an account is deleted. This page will describe a real retention schedule once one exists; until then it says so rather than inventing one.
What does exist: you can export a machine-readable copy of your account data at any time, and delete your account at any time, both from the account page (Section 7). Deleting your account removes your API keys, watchlist, saved searches, favourites and watch rules immediately. Traceroute measurements you submitted are kept - they are also shared network-measurement data other users rely on - but the link to your identity is removed at the same time.
From your account page, signed in, you can:
If you are in a jurisdiction that grants further rights over your personal data (for example under GDPR, if you are in the EU, or under Quebec Law 25 or PIPEDA if you are in Canada), and the self-service tools above do not cover what you need, email us at [email protected] and describe the request. We aim to respond within 30 days.
BGPScout is a business/technical tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.
This page states what the code does. Whether what the code does is compliant with the following is a question for counsel, listed here so it is not lost:
We will post changes here and update the date below. Questions about this policy or a request under Section 7: [email protected].
Draft prepared 2026-08-21, from the codebase as it stood that day. Not yet reviewed by counsel. Do not remove the draft banner above until it has been.