My client requests the data from your client:

<iq type='get' from='teddsterr@teddste.rr/b21e986c' to='schimon@schim.on/a1c0fcb9' id='213ff41b010008fc04d39795c0cde8b980839dc1'>

  <data xmlns='urn:xmpp:bob' cid='sha1+4e213cc5338c048171253fa49654b664ae50a6ed@bob.xmpp.org'/>

</iq>

This is sent: my client → my server → your server → your client — no IP address is included.

Your client then replies with the requested data:

<iq type='result' from='schimon@schim.on/a1c0fcb9' to='teddsterr@teddste.rr/b21e986c' id='dd3552c1a3d4f05f8f22a8497d5c8a6d59d9bb4c'>

  <data xmlns='urn:xmpp:bob' cid='sha1+4e213cc5338c048171253fa49654b664ae50a6ed@bob.xmpp.org' type='image/png'>

    iVBORw0KGgoAAAANSUhEUgAAALQAAAB4AQMAAABhKUq+AAAABlBMVEXHSwoYDRfNXBe9AAACOUlEQVRI

    x9XTsWsTURwH8N/1AsmWgA4OSkZHCx51KX24uZT+CaFDcXSwrUvgpQ46WDqLiC4dBadOStOrc+hBEAVN

    L6XDDRIMBnlH8+59HS6X5N29gwSK2jc9Pvz4vd/v994jilcVANCn9LosZ//Uw//J35pdLZhd0ntjXwFZ

    Rv9BhK7hXvbIMvq7EnGTL5csbrrf1ysWkwaXDyyOjPMhXrgMRym2AIUzninIBjA8YpnGygBOKTugKvD7

    jQ2kCwKAjyzjHAA+KEBlTm1CIO0MAISIuO42AAUIAEgXqYDgM9c9fgsIGimPGecNprk98mPS85djjo5J

    z8NH8U9tLd5C4juaF0fcXNC9nMTbrubVEUvbNvtjPQ9LnNtmr+b4jScAGpm2IgyAqQeUlCmpCEweUNKu

    kqXn0z9vPIb6ShkA7JCI5FSe+q0aAPhoEFNT5x7SYbzp2gBRmNR5ShHGq0tqPDdLTLxP2En2LjQfJPtP

    uhvXLO7n+E+zD0XTHB/k5BFz1mM8d4horjzRvHPg8eebOd4HMLyU+c/nYlKuIV7dyfHbZpd5/tDs4UmO

    +2a/yOnrVY7v5nj5r8/5qvqzxfUgPGGD+07V3avw3QovXDtzKrT0shVc1PivVcdv7bex34YzaF33aPnr

    OQZrLFx1fHdpEY6Hwt1WoUL1m1HQr/Gos8k6xS8o3MOW6Gx4dPC9F4g1LnsHfme7ja02NkVv27tSc+uv

    S48bPGzJdo57pjyyE/mmeNlT3x7NVs8fP1tbi8CsEKUAAAAASUVORK5CYII=

  </data>

</iq>

This is sent: your client → your server → my server → my client — no IP address is included.