Last updated: August 9, 2026

Privacy Policy

This policy describes how information is processed when you use randomiban.co or the RandomIBAN Android app, which third-party services are present, and the controls available to you. RandomIBAN is an independently operated project, not a bank or financial institution.

1. Contact and responsibility

For privacy, legal, or data-rights questions, contact the site operator at [email protected]. RandomIBAN is an independently operated project and does not publish a postal address.

2. IBAN generator, validator, and local storage

IBAN generation and MOD-97 validation run in your browser. The tool does not submit generated or pasted IBAN values to RandomIBAN, and those values are not included in the analytics event payloads implemented by this site. Generated values may appear in the page URL fragment and may be saved in your browser's local storage as recent history. URL fragments are not sent in normal HTTP requests, but anyone who can access your browser or a shared URL may be able to see them.

You can remove local history, theme, and language preferences by clearing site data in your browser. Do not paste real customer banking data into a public website when your organisation's policies prohibit it.

3. Technical data and security logs

The hosting and content-delivery providers used to serve the site may receive standard request data such as IP address, timestamp, requested URL, referrer, browser or device information, and security signals. These records are used to deliver the site, diagnose errors, prevent abuse, and maintain security. Images or flags loaded from a separate CDN can cause that provider to receive a similar request.

Error monitoring

To keep the site reliable, we use Sentry, an error-monitoring service, to receive a sanitized report when browser code fails. A report may contain the error category, code location, page path without query parameters or fragments, site domain, and deployment version.

Before transmission, our code removes error messages, tool inputs and outputs, form values, user details, cookies, headers, request bodies, interaction history, and stack-frame variables. Session replay, performance tracing, logs, and metrics are disabled. Sentry necessarily receives connection data such as an IP address when accepting the report and processes it as our service provider. Read Sentry's privacy notice.

4. Google Analytics and Tag Manager

RandomIBAN uses Google Tag Manager and Google Analytics 4 to measure aggregate page and tool usage. Events can include the page, tool name, selected country, action, export format, quantity, and the host of a clicked related tool. They are deliberately allowlisted so an IBAN value or arbitrary form input is not sent as an analytics parameter. Google may still receive technical request data such as IP address, browser information, and consent state.

In the EEA, United Kingdom, and Switzerland, Google storage consent defaults to denied in the site code. Outside those regions, the site's default is granted because the current consent message is not shown there. Depending on your location and choices, Google may receive limited cookieless measurement signals even when storage is denied. Learn more in Google's Privacy Policy.

5. Google AdSense and advertising

Substantive, indexable generator, validator, and article pages may load the Google AdSense code. RandomIBAN does not load that advertising script on the privacy policy, terms, contact page, HTML sitemap, cheatsheets marked noindex, or localized country variants marked noindex. Google may process device identifiers, IP address, approximate location, ad interactions, consent signals, and cookies or similar storage to deliver, limit, measure, and protect advertising.

In the EEA, United Kingdom, and Switzerland, personalised advertising requires a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework. Advertising and analytics storage remain denied by default until an applicable consent signal updates them. The AdSense account's certified Privacy & messaging CMP must be enabled before personalised ads are served in those regions. Where Google's message is active, its “Privacy and cookie settings” control lets you revisit your choice.

See how Google uses information from sites that use its services and Google My Ad Center.

6. Android app, Google AdMob, and consent

The RandomIBAN Android app generates and validates IBANs on your device and stores saved vault entries locally. RandomIBAN does not receive the IBANs you generate, validate, or save in the app. The free tier uses the Google Mobile Ads SDK to serve advertising through Google AdMob. Google states that the SDK automatically collects and shares the following data for advertising, analytics, and fraud prevention:

  • IP address, which may be used to estimate the device's general location;
  • app interactions, including app launches, taps, and video views;
  • diagnostic information, including app launch time, hang rate, and energy usage; and
  • device and account identifiers, including the Android advertising ID, app set ID, and, when applicable, other identifiers related to accounts signed in on the device.

Google says this SDK data is encrypted in transit. The Android advertising ID can be reset or deleted through Android's advertising controls. See Google's Google Mobile Ads SDK data disclosure for the current SDK details.

Where required, the app uses Google's User Messaging Platform (UMP) to request your consent choices before requesting ads. When Google requires an ongoing privacy-options entry point, the app displays a “Privacy options” control so you can revisit those choices. Your choice can change the type of ads Google may serve. Google explains that non-personalised ads can still use mobile identifiers for frequency capping and aggregate reporting, while limited ads can still use data such as IP address to deliver an ad. An active Pro subscription removes all in-app advertising.

On launch, the app makes a best-effort request to randomiban.co/api/app-version to learn whether an important update is available. The request does not include an IBAN, vault content, advertising ID, or account information, but the hosting and security providers can receive standard request metadata such as IP address, timestamp, and device or network information as described in section 3.

Optional Pro subscriptions are offered and restored through Google Play Billing. Google processes your Google Play account, purchase status, and payment information under its own terms. RandomIBAN does not receive payment-card details or send purchase receipts to a RandomIBAN server. The app stores only the product identifier for an active Pro entitlement on your device so it can apply ad-free and higher-limit features, and rechecks that entitlement with Google Play when applicable.

Vault entries, including the IBAN, optional label and notes, country, and creation time, and the local Pro product identifier are kept in Android app storage on your device. You can delete individual vault entries or clear the whole vault in the app. Clearing the app's storage removes its locally stored data; managing or cancelling a subscription is done through Google Play.

Learn more in Google's Privacy Policy and Google's explanation of data use in partner apps and sites.

7. Contact messages

The contact form builds a mailto: link and opens your email application; it does not submit the message to a RandomIBAN web endpoint. Your email provider and the recipient's provider process the name, address, message, and metadata you choose to send under their own terms.

8. Sharing, sale, and international processing

The operator does not sell personal information. Data may be processed by hosting, security, CDN, analytics, advertising, app-store, and email providers to provide their services, comply with law, or protect users, the app, and the site. Those providers may process data outside your country using the safeguards they describe in their privacy documentation.

9. Retention

Browser history remains on your device until you clear it. Android vault entries and the cached Pro product identifier remain in app storage until you delete them, the entitlement is removed, or you clear the app's storage. Server and security logs are retained only as long as reasonably required for delivery, troubleshooting, abuse prevention, and legal obligations. Google and email providers apply their own retention settings and policies. RandomIBAN does not claim a shorter retention period where it cannot control a provider's systems.

10. Your choices and rights

You can block or clear browser storage, use browser tracking protection, decline consent where a consent message is shown, revisit required mobile-ad choices through the app's “Privacy options” control, reset or delete Android's advertising ID, delete the app's vault entries, clear app storage, manage Pro through Google Play, or stop using the app or site. Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal data, and to complain to a supervisory authority. Email [email protected] to make a request concerning data controlled by the site operator.

11. Children and policy changes

RandomIBAN is a developer and QA utility and is not directed to children. This policy may be updated when the site, providers, or legal requirements change. The effective date above identifies the current version.