§01 Who We Are
UUIDForge ("we", "us", or "our")
is an independent open-source project that operates the website at
uuidforge.dev. We are not a registered company; UUIDForge is maintained
by a small team of developers committed to building privacy-respecting tools.
For any privacy-related enquiry, reach us via the
Contact page or email
privacy [at] uuidforge.dev.
§02 Data We Collect
The table below provides a complete inventory of every data category UUIDForge touches, why, and for how long.
| Data type | Collected? | Purpose | Retention |
|---|---|---|---|
| UUIDs you generate | ✓ Browser only | Generation runs entirely client-side; never transmitted | Cleared on tab close |
| IP address | Server log | Automatic HTTP log entry by the web server | 7 days, then purged |
| Browser / OS (User-Agent) | Server log | Standard HTTP request header | 7 days, then purged |
| Referrer URL | Server log | Standard HTTP request header | 7 days, then purged |
| Cookies | ✗ None set | — | — |
| Analytics events | ✗ None | — | — |
| Contact form submissions | On submission | Reply to your message | 90 days after resolution |
| v5 name strings | ✓ Browser only | Hashed locally via crypto.subtle; never transmitted |
Cleared on tab close |
§03 UUID Generation & Browser Privacy
This is the most important section for most users. Every UUID generated on UUIDForge — whether v1, v4, or v5, single or bulk — is computed entirely inside your browser. Specifically:
UUID v4 uses crypto.getRandomValues(new Uint8Array(16)), which draws
entropy from your operating system's CSPRNG via the browser's Web Crypto API.
UUID v1 uses Date.now() and crypto.getRandomValues() for
the clock sequence. UUID v5 passes the namespace and name string to
crypto.subtle.digest('SHA-1', …) — all computation local.
Our FastAPI server responds to the initial page request and serves the HTML, CSS, and JavaScript. After that, the server is not involved in any UUID generation. There is no WebSocket, no polling endpoint, no analytics beacon — nothing that could carry UUID data to our infrastructure.
You can verify this by opening your browser's DevTools → Network tab and filtering for requests made after the page loads. You will see zero outbound requests during generation activity.
§04 Server Access Logs
Like every website on the internet, our web server (nginx / uvicorn) automatically
records standard HTTP access logs when your browser requests a page. These logs
contain: your IP address, the URL path you requested, the HTTP status code, the
size of the response, your browser's User-Agent string, and the
referring URL (if any).
These logs are used exclusively for security monitoring (detecting DDoS attempts, scanning bots, and abuse) and infrastructure diagnostics (identifying 5xx error patterns). We do not use them for marketing, profiling, or any analytical purpose. Logs are automatically purged after 7 days.
We do not correlate IP addresses across sessions, and we do not attempt to de-anonymise or re-identify any visitor from log data.
§05 Contact Form Data
If you submit a message via the Contact page, we collect your name, email address, the subject and body of your message, and the topic category you select. This data is used solely to understand and respond to your enquiry.
We do not add you to any mailing list, marketing database, or CRM without your explicit consent. We do not share contact form submissions with any third party. Submissions are stored in an encrypted mailbox and permanently deleted 90 days after the conversation is resolved.
The legal basis for processing this data under GDPR Article 6(1)(b) is
performance of a contract (responding to your request). You may request
deletion of your submission at any time by emailing
privacy [at] uuidforge.dev.
§06 Cookies & Local Storage
UUIDForge sets zero cookies. We do not use session cookies, persistent cookies, tracking pixels, or any equivalent technology.
We also do not write to localStorage or sessionStorage.
The only browser-side state maintained during your visit is held in JavaScript
memory (the in-page UUID history list) and is discarded the moment you close or
navigate away from the tab.
Because we set no cookies, no cookie consent banner is required or shown. There is nothing to consent to.
§07 Third-Party Services
UUIDForge loads the following external resource on page load:
| Service | Purpose | Data sent | Their privacy policy |
|---|---|---|---|
| Google Fonts | Load Space Mono and Syne typefaces | Your IP address and User-Agent (standard HTTP request) | policies.google.com |
That's it. No analytics platform, no advertising network, no CDN-hosted JavaScript library, no social media widget, no A/B testing service. If you wish to avoid even the Google Fonts request, you can self-host UUIDForge with the fonts downloaded locally — instructions are in the repository README.
§08 Your Rights
Under GDPR (EU/EEA), CCPA (California), PIPEDA (Canada) and similar frameworks, you have the following rights with respect to any personal data we hold:
Request a copy of any personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your personal data ("right to be forgotten").
Ask us to pause processing while a dispute is resolved.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests.
Because we collect almost no personal data, most rights requests will resolve
immediately (there is simply nothing to produce or delete). To exercise any right,
contact us at privacy [at] uuidforge.dev. We will respond
within 30 days in accordance with GDPR Article 12.
If you are an EU resident and believe we have mishandled your data, you have the right to lodge a complaint with your national Data Protection Authority (DPA). A list of EU DPAs is maintained by the European Data Protection Board.
§09 Data Retention
We apply a minimal-retention policy across every data category:
Server access logs are automatically rotated and deleted after 7 days. Contact form submissions are deleted within 90 days of the conversation being resolved. If your enquiry is ongoing, data is retained until resolution and then deleted within 7 business days.
We have no long-term data warehouse, no data lake, and no backup system that retains logs beyond the periods stated above.
§10 Children's Privacy
UUIDForge is a developer tool intended for users aged 13 and over (or 16 and over in jurisdictions where GDPR applies to minors under 16). We do not knowingly collect personal data from children below these ages.
If you are a parent or guardian and believe your child has submitted personal
data via our Contact form, please contact us immediately at
privacy [at] uuidforge.dev and we will delete the
information without delay.
§11 Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, display a notice on the home page for at least 30 days.
We will never introduce changes that reduce your privacy protections without providing a meaningful opt-out mechanism. We will never introduce advertising, analytics, or data-sale practices — doing so would contradict our core mission.
Previous versions of this policy are available on request via
privacy [at] uuidforge.dev.
§12 Contact the Privacy Team
For all privacy-related matters — data access requests, deletion requests, policy questions, or concerns — please reach us through one of the following channels:
Email: privacy [at] uuidforge.dev
Contact form: uuidforge.dev/contact
(select Security concern or Other)
Response time: Within 30 days for formal GDPR/CCPA requests;
within 48 hours for general questions.