Privacy Policy

In short

• Data files and passwords are generated in your browser. What you download and the passwords you create are never sent to us.
• You can use the generators without an account. An account keeps your saved schemas, password presets, AI runs, mock APIs and plan.
• We use only the cookies the site needs to work. No advertising, no tracking across sites, and we never sell your data.
• We count visits with privacy-friendly analytics that sets no cookies and cannot identify you.
• You can delete your account yourself in your account settings. If you own a team with other members, remove them first.

Who is responsible

The controller of your personal data is:

What we collect and why

When you visit the site

Our servers record technical data with each request: IP address, browser, the page asked for, the time and, when you are signed in, your account number. We use it to deliver the site, stop abuse and fix errors, and keep it for no more than 30 days. Rate limits count requests per IP address in memory. Requests that hit a limit or fail a check (a wrong password, for example) are also counted per hour, IP address and account so we can spot abuse; these counts are kept for 30 days. Legal basis: our legitimate interest in a secure, working service (GDPR Art. 6(1)(f)).

Visit statistics

To see which pages are useful, we count visits with Plausible Analytics, which we run on our own server (stats.iig.global). It records the page, the referring site, the browser, operating system and device type, and the country, which it works out from the IP address without storing it. It sets no cookies, stores nothing in your browser and does not follow you to other sites. Visits are counted with an identifier that changes every day, so they cannot be linked to you or to each other over time. Legal basis: our legitimate interest in improving the site (Art. 6(1)(f)).

Your account

Your email address, the name you give, a scrypt hash of your password if you set one (never the password itself), and when you last signed in. If you sign in with Google, we receive your name, email, profile picture and Google account ID from Google. We also keep the schemas, collections, folders and password presets you save; a password preset holds the generator settings, never the passwords themselves. Legal basis: providing the service you signed up for (Art. 6(1)(b)).

If you had an account on the previous version of rndgen.com, we carried over your email address, user name, profile picture link, sign-up date and saved templates, collections and folders, so you find them here. Your old password was not carried over. Legal basis: our legitimate interest in continuing the service you used (Art. 6(1)(f)).

AI data

When you use Create with AI, the description you type is sent to our AI provider, Anthropic, which returns the fields and their value lists; the rows are then generated in your browser. We keep the description for 90 days, together with the time and cost of the request, to apply plan limits and investigate problems; after that only the time, model, status and cost remain. If you delete your account, the descriptions are deleted at once, and those records stay without your name or account, for our cost records. Each request also carries a keyed hash of your email address for up to 32 days, so that deleting an account and signing up again does not reset the free AI allowance; the hash cannot be turned back into the address. Answers are cached for 30 days so the same description does not need a new request. Do not put personal or confidential data in descriptions. Legal basis: providing the service (Art. 6(1)(b)).

Mock APIs

A mock API keeps its records on our servers: fake data generated from your schema, plus whatever is sent to it. Anyone with its address can read and change those records, so treat the address like a password and never send real personal data to it. Records stay until you reset or delete the mock API or your account. We count requests per day to apply plan limits and keep those counts for 90 days.

Teams

To invite someone, a team owner or admin gives us their email address, and we send them an invitation that shows the name or email of the person who sent it and expires after 7 days. Members of a team see each other's names, email addresses and roles, and the email addresses of pending invitations. They can view, change and delete everything in the team library. What you add to a team library stays with the team if you leave it or delete your account, and passes to the team's owner.

Payments

Payments are processed by Stripe. Card details go directly to Stripe and never reach us. Stripe may act as the seller of record for your purchase (shown as Link at checkout), in which case it is responsible for the payment and tax data it collects under its own privacy policy. When you start a purchase, we send Stripe your email address, name and account number to create your customer record. We receive and keep your Stripe customer reference and the plan, status, number of seats and dates of your subscription. Legal basis: providing the service and our legal obligations (Art. 6(1)(b) and (c)).

Emails

We send sign-in links, password resets, a notice when someone tries to sign up with your address, team invitations, and notices about important changes to our terms, prices or this policy, and we reply when you write to us. We do not send newsletters or marketing emails. If you write to us, we keep the conversation as long as needed to help you and for our records.

Who processes data for us

We use these providers, each bound by a data processing agreement or acting under its own terms where noted:

Where data goes outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.

How long we keep data

Expired data is removed automatically every hour, so it can take up to an hour past these periods to disappear.

Your rights

You can ask for a copy of your data, have it corrected, deleted or moved to another service, restrict or object to how we use it, and withdraw any consent you gave. You can delete your account yourself under Account → Profile; it removes your profile, saved schemas, collections and mock APIs, and ends any paid plan at once. What you added to a team library, mock APIs included, stays with that team and passes to its owner. If you own a team with other members, remove them first or write to us to hand the team over. For anything else, write to[email protected]; we answer within one month.

If you think we handle your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the authority in the country where you live.

Security

The site runs over HTTPS only. Passwords are stored as scrypt hashes, and sign-in links and sessions as hashes of random tokens, so a copy of our database would not reveal them. Access to servers is limited to the people who run the service.

Children

RNDGen is a tool for professionals and is not meant for children. Do not create an account if you are under 16.

Changes

When this policy changes, we update the date at the top. If a change matters for how we use your data, we tell account holders by email before it applies.