My client requests the data from your client: <iq type='get' from='teddsterr@teddste.rr/b21e986c' to='schimon@schim.on/a1c0fcb9' id='213ff41b010008fc04d39795c0cde8b980839dc1'> <data xmlns='urn:xmpp:bob' cid='sha1+4e213cc5338c048171253fa49654b664ae50a6ed@bob.xmpp.org'/> </iq> This is sent: my client → my server → your server → your client — no IP address is included. Your client then replies with the requested data: <iq type='result' from='schimon@schim.on/a1c0fcb9' to='teddsterr@teddste.rr/b21e986c' id='dd3552c1a3d4f05f8f22a8497d5c8a6d59d9bb4c'> <data xmlns='urn:xmpp:bob' cid='sha1+4e213cc5338c048171253fa49654b664ae50a6ed@bob.xmpp.org' type='image/png'> iVBORw0KGgoAAAANSUhEUgAAALQAAAB4AQMAAABhKUq+AAAABlBMVEXHSwoYDRfNXBe9AAACOUlEQVRI x9XTsWsTURwH8N/1AsmWgA4OSkZHCx51KX24uZT+CaFDcXSwrUvgpQ46WDqLiC4dBadOStOrc+hBEAVN L6XDDRIMBnlH8+59HS6X5N29gwSK2jc9Pvz4vd/v994jilcVANCn9LosZ//Uw//J35pdLZhd0ntjXwFZ Rv9BhK7hXvbIMvq7EnGTL5csbrrf1ysWkwaXDyyOjPMhXrgMRym2AIUzninIBjA8YpnGygBOKTugKvD7 jQ2kCwKAjyzjHAA+KEBlTm1CIO0MAISIuO42AAUIAEgXqYDgM9c9fgsIGimPGecNprk98mPS85djjo5J z8NH8U9tLd5C4juaF0fcXNC9nMTbrubVEUvbNvtjPQ9LnNtmr+b4jScAGpm2IgyAqQeUlCmpCEweUNKu kqXn0z9vPIb6ShkA7JCI5FSe+q0aAPhoEFNT5x7SYbzp2gBRmNR5ShHGq0tqPDdLTLxP2En2LjQfJPtP uhvXLO7n+E+zD0XTHB/k5BFz1mM8d4horjzRvHPg8eebOd4HMLyU+c/nYlKuIV7dyfHbZpd5/tDs4UmO +2a/yOnrVY7v5nj5r8/5qvqzxfUgPGGD+07V3avw3QovXDtzKrT0shVc1PivVcdv7bex34YzaF33aPnr OQZrLFx1fHdpEY6Hwt1WoUL1m1HQr/Gos8k6xS8o3MOW6Gx4dPC9F4g1LnsHfme7ja02NkVv27tSc+uv S48bPGzJdo57pjyyE/mmeNlT3x7NVs8fP1tbi8CsEKUAAAAASUVORK5CYII= </data> </iq> This is sent: your client → your server → my server → my client — no IP address is included.