The trouble with API keys that never expire
A key issued years ago, never rotated, and still valid today is not a convenience. It is a liability nobody has actually looked at in years.
Why we don't track visitors to sell you analytics
There is a version of a location data business that looks like an API on the surface and works like an analytics broker underneath. The API answers your requests, sure, but every one of those requests also feeds a second product: aggregated visitor data, sold onward to advertisers, data brokers, or anyone else interested in knowing which IP addresses are looking at which sites. The customer paying for the API is often the last person to find out this is happening, because it is never the headline feature on the pricing page.
We do not run that second business. My Geocode answers the lookup you send it and does not retain that traffic to build a resellable analytics product. There is no tracking script embedded anywhere on our side that would let us watch behavior beyond the request itself, and IP geolocation happens server side, as a direct answer to your API call, not as a hook into a broader surveillance pipeline.
The incentive for building that second business is easy to understand. IP geolocation traffic is genuinely valuable to advertisers and data brokers, because it offers a rough but usable signal about where people are and what sites they visit. A provider charging a low headline price for the API itself can make up the difference, and then some, by monetizing the traffic a second time on the back end. This is exactly the kind of business model that never gets explained clearly to the customer whose traffic is the product, because explaining it clearly would make the low headline price look a lot less generous.
We chose not to build that second business, which means our revenue has to come entirely from the API itself: the free allowance, prepaid credit at €0.0001 a request, and the €50 Unlimited key. That is a real constraint, not just a talking point. It means the price of the product has to actually reflect what it costs to run, because there is no hidden second revenue stream quietly subsidizing it.
There is also a simple trust argument here that matters regardless of the business model behind it. A company that resolves your customers' IP addresses as part of your checkout flow, your fraud check, or your content localization is handling data about people who never chose to interact with that company directly. They chose to interact with you. Whatever that company does with the data it sees as a byproduct of serving your request is a decision made on your customers' behalf, without their knowledge, unless the provider is explicit about not doing anything with it beyond the answer.
We would rather be explicit: the request is the product. Nothing about your traffic gets aggregated, packaged, or sold to a third party as a side effect of using our API. If that ever changes, it would be a different business than the one you signed up for, and we do not intend to become that business.