Every request carries more than a page address. Before a single line of JavaScript runs, the server knows the IP address and whose network it is, which TLS version and cipher were negotiated, which languages the browser prefers, whether it sends a Global Privacy Control signal, and, in Chromium, the Client Hints that replaced the user agent string. This tool asks this server to report exactly that for the current connection, and sets it beside what the browser says about itself. Where the two disagree, an extension, a proxy or a VPN is usually in between.
The request goes to this server only; nothing is stored beyond the hourly rate counter, and the answer is shown only here. Cookie values and authorisation headers are never returned, only cookie names. The reverse DNS lookup and one RDAP query for the network owner run on this server.
Limits worth knowing: the headers shown are those of a background fetch request, which carries fewer Sec-Fetch and Accept values than a page navigation; the HTTP version is what this server negotiates, not the best the browser can do; the network owner comes from the regional registry and names the provider, not a person; and the hosting hint is a heuristic on the network name.