Apache :: Geo locating customer ip: safe/ok to do?

walt · Joined: 24 Oct 2015 Posts: 25

Hello, I have a web site selling my own programs. I try to use as little of the customer's personal information as possible. For example, if they use Paypal, they do not have to enter their physical address. Only the email is needed, so their download links can be sent. When they use the download links, their ip is also recorded. It is used so that only they can download again, anytime in the future.

All good, except it would be nice to know what part of the world they are from. Paypal will only supply country, but I would at least city as well. I could geo locate their ip, but I'm concerned of exposing them to possible spam, or data collection. Is this a real concern? If so are there some geo locating services that are considered 100% safe? Any thoughts?

Thanks!

gijs · Joined: 27 Apr 2012 Posts: 189 Location: The Netherlands

How would you allow users with a dynamic IP to download the file if the download is locked to one IP?
What if users are on a different network (e.g. laptop at work/hotel or switched ISP) and need to download the application?

I don't see any privacy issues with logging the IP addresses as long as you don't publicly expose them.
A geolocating service would only know that an IP is being looked up by your server, unless they also match your website to that server they won't be able to collect useful data on it.

walt · Joined: 24 Oct 2015 Posts: 25

Hello, thanks for the input. After posting it did seem like a dumb question, but I was not 100% sure.

For your downloads questions, I have been manually sending emails with download links, for several years. What I have now is a big improvement in convenience, but only a first step.

Looking towards how to handle repeat downloads, I am recording this data on first download:
$_SERVER['REMOTE_ADDR']
$_SERVER['HTTP_X_FORWARDED_FOR']

I was hoping to use 'HTTP_X_FORWARDED_FOR' as extra information, but the system is still too young, only about 15 downloads so far. No one has had 'HTTP_X_FORWARDED_FOR' set, so nothing to look at or play with. I realize this is also flawed, but another small step towards a solution. This is why I am looking into geo location as well, maybe all together they cold work well enough.

I could just have the person enter information about their purchase, but I would like to avoid this if possible. Maybe just have it as a backup if their links no longer work.

James Blond

I use http://www.utrace.de/ They also offer an API.