Privacy policy.

WhatWorks (whatworks.tech) is operated by DGMA Limited, Queen’s Road Central, Sheung Wan, Hong Kong. We are responsible for the personal data described in this policy.

We follow Hong Kong's Personal Data (Privacy) Ordinance. If you are in the United Kingdom or the European Union, the UK GDPR or the EU GDPR also gives you the rights described below, and this policy is written to meet them.

For any privacy question, write to [email protected].

When you browse the site. Our hosting provider and Cloudflare, which delivers and protects the site, automatically process technical data: your IP address, browser and device type, the page you asked for, the page you came from and the time. We use it to deliver pages, keep the site secure and fix errors.

When you email us. Your email address, your name if you give it, and what you write. We use it to reply and to keep a record of the conversation.

We do not offer accounts, take payments or ask for sensitive information.

We use Google Tag Manager, a Google service that loads measurement tags on our pages. These tags are set to store no cookies on your device until you agree to analytics cookies, and we do not set cookies for analytics or advertising without your consent. Google processes the data these tags send under its own privacy policy.

Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell people apart from automated traffic. It does not identify you and expires after 30 minutes.

If we add analytics or any other non-essential cookies, we will update this policy first and ask for your consent where the law requires it.

Our tools, such as What is my IP and the WebRTC leak test, show you information about your own connection.

• Your IP address and its location. We read your IP address, and the approximate location Cloudflare derives from it (country, region, city, coordinates for the map, time zone and network number), from the request your browser sends to our server, and send them straight back to your browser. We do not store them, apart from the technical logs described above.
• VPN IP checks. The VPN IP checkersends our server your own address, or an address you type in, and looks it up in copies of public network, VPN, data-center and Tor lists kept on our server, so the address is not passed to another company for the lookup. Our server also asks the DNS for the host name of that address, as any server can. We do not store the address or the result, apart from the technical logs described above. To stop abuse, the server counts each visitor's checks in memory for about a minute, then forgets them. An address you check appears in the page link, so you can share the result; it stays in your browser history like any link.
• WebRTC checks.Your browser sends a request to Cloudflare's public STUN server (stun.cloudflare.com), which replies with the public address it sees. The addresses your browser finds are compared in your browser and are not sent to us.
• What you choose in a tool, such as the server country in the VPN check, stays in your browser.

When you follow a link from WhatWorks to a VPN provider or another site, that site's own privacy policy applies. The provider, and any affiliate network that records the referral, may use cookies on their own site to know you came from WhatWorks.

Our links can carry a reference code that identifies WhatWorks and the page you came from, not you. The reports we receive show clicks and sales in aggregate; they do not include your name or payment details. See how we make money.

• Legitimate interests: to deliver the site and the tools you use, keep it secure and answer your emails.
• Consent: for any non-essential cookies, if we ever use them.
• Legal obligation: where the law requires us to keep or share information.

We share personal data only with the companies that run services for us, under contracts that protect it:

• our hosting provider, which runs the servers;
• Cloudflare, which delivers and protects the site;
• our email provider, which hosts our inbox.

We never sell personal data. We disclose it to authorities only when the law requires us to.

We are based in Hong Kong, and our providers, such as Cloudflare, may process data in other countries, including the United States. When personal data about people in the UK or the EU is transferred, we rely on adequacy decisions or on approved safeguards such as standard contractual clauses, with the UK addendum where needed.

• Technical logs: up to 30 days, unless we need them longer to investigate a security problem.
• Emails: up to 24 months after our last exchange.

You can ask us for a copy of your personal data and ask us to correct it. If you are in the UK or the EU, you can also ask us to delete it, restrict or object to its use, or send it to you in a portable format. Where we rely on consent, you can withdraw it at any time. We reply within one month.

If you are unhappy with how we handle your data, please tell us first. You can also complain to Hong Kong's Privacy Commissioner for Personal Data (pcpd.org.hk) or, if you are in the UK, to the Information Commissioner's Office (ico.org.uk), or in the EU to your national data protection authority.

WhatWorks is not aimed at children under 13, and we do not knowingly collect their personal data.

When we change this policy, we update the date at the top of this page. If a change is significant, we say so here.

Email [email protected].