Privacy

Scanning happens on your computer

A scan is sent from the machine running the application to the addresses you pointed it at, and nowhere else. It uses ordinary operating-system networking — the same ping and TCP connections any program makes — so it needs no administrator rights and no driver.

Scan results are not uploaded

Discovered devices, their addresses, hostnames, MAC addresses, manufacturers and open ports are held in memory for as long as the window is open. They are written to disk only when you export a CSV yourself, to the location you choose.

There is no inventory database and no scan history, in either edition. Closing the application ends the session. That is deliberate: the same copy of this tool gets pointed at many unrelated customer networks, and one customer’s device list has no business surviving into the next site visit.

No account, no telemetry, no analytics

• There is no sign-in, no licence key and no account of any kind.
• No usage data, crash report, device identifier or scan statistic is collected.
• There is no analytics service, and no advertising or tracking code.
• There is no cloud database and no server operated for this application.

What is stored between launches

Only your own interface preferences: theme, row height, which columns are shown, their widths, your scan settings, the adapter you last chose and the last few targets you typed. Nothing about the devices found on any network is stored.

The installed edition keeps these in its ordinary Windows per-user application-data folder. The portable edition keeps them in a separate folder alongside it, so a portable copy and an installed copy never share preferences. Neither edition writes to the folder the executable sits in.

The network requests the application makes

There are two, both listed here. Neither sends scan results or discovered-device data.

The public IP lookup. The network summary at the top of the window shows the address this network appears as from outside. That is the one fact the application cannot work out for itself, so it asks api.ipify.org — or icanhazip.com if the first is unreachable — which answers with your address in plain text and nothing else. Like any HTTPS request it tells that service your IP address, which is the answer you asked it for; it sends no identifier, no scan result and nothing about the network you are on. It runs when the window opens and when you press refresh, never otherwise, and it can be turned off in Settings, where both services are named. The application’s Content-Security-Policy lists these two hosts, so the window cannot reach anywhere else even if it tried.

The update check. The installed edition asks the GitHub Releases API which stable version is current shortly after the installed app opens, and again when you press “Check now” in About. If a signed in-app updater manifest is available, it can install that release in place; otherwise it opens the normal download page. The startup check is silent unless a newer version exists. Like any HTTPS request, it tells GitHub your IP address; it sends nothing about your network or your scans.

The portable edition does not contain the updater at all. It is compiled without it, rather than having the button hidden, so there is no update check to make.

The buttons that open this website, the releases page or a discovered device’s own web interface hand a URL to your default browser. What happens after that is between you and that address.

This website

This site is static files on GitHub Pages. It loads no web fonts, no analytics and no third-party scripts, which its Content-Security-Policy enforces rather than promises. It makes one request of its own, to the GitHub API, to fill in the current version’s download links and file sizes; if that request is blocked the page still works and the buttons point at the releases page. GitHub operates the hosting and that API, and keeps its own server logs.

Scope

EXP IP Scanner is a read-only discovery and administration utility. It does not attempt authentication, does not test credentials, does not exploit anything and does not change any device it finds. Scan only networks you are authorised to inspect.

Changes to this notice

This page describes the version named above. If a future version changes what is stored or what is sent, this page changes with it, and the release notes say so.