Privacy policy

Who we are

uncoalesced (“we”, “us”, “our”) is an independent engineering collective based in India that publishes open-source software. This policy covers the website at uncoalesced.com (the “Site”). For the Site we are the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), and the controller under the EU and UK General Data Protection Regulation (“GDPR”). Contact: mail@uncoalesced.com.

Personal data we collect

Data you give us. If you use the contact form or email us, we receive your name, your email address and whatever you write in the message. Nothing else is asked for, and we never ask for a phone number.

Data collected automatically. When your browser requests a page, our host receives your IP address, browser user agent, the page requested and the time, as every web server does. We do not collect anything beyond what is needed to deliver the page and protect the Site from abuse.

Data we do not collect. No accounts, no payment data, no location, no device fingerprinting, and no data about you from third parties or public sources. Cursor positions used by the Site’s visual effects stay in your browser and are never recorded or sent.

Cookies and similar technologies

The Site sets no cookies and uses no analytics, advertising, tracking pixels, web beacons or third-party scripts. Fonts and all other assets are served from our own domain, so your browser contacts no one but us.

Two values are stored in your browser’s session storage, which is strictly necessary functionality that never leaves your device and is cleared when you close the tab:

• whether the intro animation has already played in this session;
• the text size you chose in the paper reader.

Because nothing tracks you, there is nothing to consent to and no cookie banner. We do not respond differently to “Do Not Track” signals, since we track no one either way.

How we use personal data

• To answer you. Contact form messages and emails are read and answered. That is their only use.
• To keep the Site running and secure. Request data is used by our host to serve pages and block attacks. The contact form counts submissions per visitor for one hour to stop spam.
• To comply with the law, if we are ever legally required to.

We do not sell, rent or trade personal data, send marketing, build profiles, make automated decisions with legal or similar effects, or use your messages to train AI models.

Legal bases

Under the DPDP Act, we process the data in a message you choose to send us on the basis of your consent, given by sending it, and for the legitimate use of responding to you. Under the GDPR, we rely on:

• Legitimate interests for answering messages you send and for keeping the Site secure and free of spam;
• Compliance with law where a legal obligation requires processing.

Who we share it with

Only the service providers that run the Site, and only for that purpose:

• Cloudflare hosts the Site and its contact endpoint, and processes request data under its own privacy policy. We have not enabled Cloudflare’s web analytics or any visitor tracking.
• Resend delivers contact form messages by email to mail@uncoalesced.com, with your address set as the reply-to so we can answer.
• Our email provider stores the messages we receive, as with any email.

We may also disclose data if the law requires it, or to protect our rights or the safety of others. The GitHub statistics on project pages are fetched by our server, so your browser never contacts GitHub through the Site.

Retention

• Contact messages and emails: up to 24 months after our last reply, then deleted. Sooner if you ask.
• Spam counter: a one-way keyed hash of your IP address, never the address itself, kept for one hour and then automatically removed.
• Server logs: our own logs never contain your name, email or message. Cloudflare keeps request data for its own limited periods.
• Session storage values: until you close the tab.

International transfers

We are based in India. Cloudflare operates worldwide and Resend is based in the United States, so your data may be processed outside your country, including in countries whose laws may protect it less. Where the GDPR applies, we rely on our providers’ standard contractual clauses or equivalent safeguards for those transfers.

Your rights

Wherever you are, you can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete it;
• erase it;
• withdraw your consent for us to keep a message, at any time.

Under the DPDP Act you may also nominate another person to exercise these rights if you die or become incapable, and you may complain to the Data Protection Board of India if we do not resolve your grievance. In the EU or UK you also have the rights to restrict processing, to object to processing based on legitimate interests and to data portability, and you may complain to the data protection authority where you live (in the UK, the Information Commissioner’s Office).

To exercise any right, email mail@uncoalesced.com. We may ask you to confirm you own the email address involved. We answer within 30 days, and if we cannot fulfil a request we will tell you why.

Grievance contact

Questions or complaints about this policy or your data go to mail@uncoalesced.com, which is monitored by the people who run the Site.

Security

The Site is served over HTTPS, applies a strict content security policy, stores no raw IP addresses and keeps no copy of contact messages outside the delivered email. No system is perfectly secure, so we cannot guarantee absolute security. If you find a weakness, our terms explain how to report it.

Sensitive data

Please don’t send us sensitive personal data such as government ID numbers, health, financial or biometric information through the form or by email. We don’t need it.

Children

The Site is not intended for anyone under 18, and we do not knowingly collect their personal data. If you are a parent or guardian and believe your child has contacted us, tell us and we will delete the message.

Other sites and our projects

The Site links to GitHub, social networks and other services we don’t control; their own policies apply there. This policy covers the Site only. Software we publish, such as Madhuca at madhuca.uncoalesced.com, documents its own data handling in its repository.

Changes to this policy

If we change this policy, we update the date at the top. Material changes will be noted on this page. See also our terms of use.