Privacy & Cookie Policy

Last updated: 14 August 2026

This policy covers the Brainrot Generator website — the character generator and the island page. It explains what is stored, what is not, and how advertising works here. It is written to be read, not to be impressive.

The short version

There are no accounts, no logins and no sign-ups.
Your characters never leave your device. They are saved in your own browser.
The site is static files. We do not run a server that takes in your creations, and there is no database of you anywhere.
We do count visits and measure how fast pages load. Two tools do that. Cloudflare Web Analytics uses no cookies and saves nothing on your device. Google Analytics does use cookies, and you can turn it off.
What runs by default depends on where you appear to be. If you look as though you are in Europe, the UK or Switzerland, nothing that uses cookies runs until you have chosen. Everywhere else, advertising and Google Analytics start straight away, and the bar at the bottom of the page says so and lets you turn either one off.
Those Google Analytics cookies are the ones this site sets itself. They hold a random number, not your name, because the site never asks for your name.
Advertising here is served through Google AdSense. Google and the advertising partners taking part may use cookies and similar technologies to show and measure ads, under their own policies.
The age question and the cookie bar are two different things. Telling us your year of birth is not consent to cookies or to personalised ads — that is what the bar is for.
Nobody is turned away. If you tell us you are under 13, the site keeps working and the advertising you see is not personalised.
You can change your mind at any time. There is a link at the foot of every page.

Who this site is for

This website is intended for users aged 13 and over. It is a 3D model creation tool: characters made here can be exported as .glb files for use in Blender, Blockbench, Unity, Godot and other 3D software. It is not directed to children under 13.

We ask for your year of birth the first time you visit, and the answer is saved in your own browser so you are not asked again. It is used for one purpose: to decide which kind of advertising is appropriate for you.

The age question is not a consent banner. Answering it does not mean you have agreed to cookies, to personalised advertising, or to your data being used. Consent is asked for separately, by the bar at the bottom of the page. The two are different mechanisms and they do different jobs.

If you tell us you are under 13, the site still works. You are not turned away and nothing is taken from you. What changes is the advertising: from then on, this site never asks Google for a personalised ad for you. The ads you get are chosen from the page you are on rather than from a profile of you.

We should be exact about what that does and does not do. Turning off ad personalisation is one specific setting, and it is the only one this site is able to send for a single visitor. It is not the same as Google's separate "child-directed" setting, which is a broader instruction that also switches off remarketing and applies Google's own child protections. This site does not send that one, because the way it shows ads gives it no way to send it for one visitor at a time. Non-personalised ads also still use cookies — Google uses them to limit how often you see the same ad and to count ads in bulk.

We used to block under-13 visitors outright. That was changed because it did not work: a blocked visitor reloads the page and types a different year, which leaves the site with a worse answer than it started with — and the answer is the only thing this question is for.

This is not age verification. It is an answer you choose from a list. We have no way to check it, we do not try, and no part of this site should be read as saying that your age has been confirmed.

Only the year is saved, never a full date, and the site works out your age from it cautiously: because a year on its own cannot tell whether this year's birthday has already happened, it always assumes it has not. That means the site sometimes treats someone as a year younger than they are, which is the safer direction to be wrong in.

What is stored in your browser

The site uses your browser's local storage. This data stays on your device, is never transmitted to us, and can be deleted by you at any time. It holds:

Your island roster — the characters you saved as pets, including their shapes and colours.
Pet positions — where each pet was last standing on the island.
Your age answer — the year of birth you chose, so we do not ask again on every visit. Only the year, never a full date.
Your cookie choices — whether you agreed to advertising and to analytics, so the bar is not shown on every page.
Your opt-out — if you used the "Do Not Sell or Share My Personal Information" link, the fact that you did.
Your language choice — whether you chose the Spanish version of the site, or dismissed the offer of it, so you are not asked on every page.
Your quality setting — if you picked Low, Medium or High on the island, the one you picked. Only saved when you choose it yourself.
Your Max FPS setting — if you changed how many frames a second the island draws, the setting you picked.
Your framerate readout — whether you turned the framerate number on the island on or off.
Your music choice — whether you turned the island's music on or off.
Your time of day setting — how fast you asked the island's day and night to run.
Your light or dark theme — which one you picked, so the site looks the same next time.
Which tab you had open — on the generator and on the island, the last panel tab you used, so it opens on that one next time.

One more thing is kept in your browser's session storage, which your browser empties as soon as you close the tab. If you use the "Do Not Sell or Share My Personal Information" link, the site notes for that one visit that it still owes you the message confirming it worked.

To pick a starting quality setting for you, and to hold the island to the Max FPS you asked for, the island checks three things about the window it is drawing in: whether you are using a touchscreen, how fast the island itself is managing to draw, and how often your screen asks it for a new picture. All three are the same kind of information the page already uses to lay itself out. It does not look at what device or processor you have, and none of these answers is sent anywhere or saved.

Cookies. A cookie is a small piece of data that your browser stores for a site. When you come back, your browser can send it to that site again. This site sets two of its own, and both belong to Google Analytics. They are not set if you have turned analytics off, and in Europe, the UK and Switzerland they are not set unless you turn it on. Google's own documentation describes them like this:

_ga — used to tell one visitor apart from another. Its default expiry is 2 years.
_ga_7SWZK2VG7Q — used to remember the state of a visit. Its default expiry is 2 years.

They use identifiers that help Analytics distinguish a browser and its visit. Neither holds your name, your email or anything you typed, because the site never asks you for those. A browser can shorten how long a cookie lasts. Neither one is needed for the site to work. If you block or delete them, the generator, the island and your saved characters all carry on exactly as before. The section below explains what they are used for, and how to switch them off.

Advertising uses cookies of its own as well. Those are separate from the two above. They are set by Google and the advertising partners taking part, not by this site, and the advertising section covers them.

This site does not ask for or store your name, email address, location, or account information, because there is nothing here that asks for them.

Visit counts and speed measurements

Two different tools count visits here, and they do not work the same way. Cloudflare Web Analytics measures how fast pages are. Google Analytics tells us which pages people actually use. The important difference for you is that Cloudflare sets no cookies and Google Analytics does, so each one gets its own section below.

This site is delivered by Cloudflare, and it uses Cloudflare Web Analytics — also called Real User Monitoring, or RUM. That is what tells us how many people came, which pages they opened, and how quickly those pages appeared on their screen. We use it to find slow or broken pages and fix them.

Cloudflare carries all traffic to this site. It sits between your browser and the files, as a reverse proxy, so every request you make passes through it. That is how the site is delivered at all, and it is separate from the measuring described here. Cloudflare's own privacy policy is at cloudflare.com/privacypolicy.

This measuring is not switched off by the cookie bar, because it does not use cookies and stores nothing on your device. It cannot be turned off separately from the site itself.

Cloudflare Web Analytics does not use cookies and it saves nothing on your device. Cloudflare says it keeps no state in your browser for analytics. That means no cookies, no local storage and no session storage. It also says it does not fingerprint you — not from your IP address, and not from your browser or your device. And it says it does not track people across websites. Nothing Cloudflare leaves here follows you from page to page, or from this site to another one.

Google Analytics is the part that does recognise your browser from one page to the next. It has its own section below.

A small script on each page sends one measurement when the page has finished loading, and one when you leave it. What it reports is:

The address of the page you were on, and the site you arrived from, if any.
Your country.
Your browser, your operating system, and whether you are on a phone, a tablet or a computer.
How long the page took to load. How quickly it answered your first tap. How much it moved around while it loaded. Those three are what Google calls the Core Web Vitals.

That message carries your IP address, as every request your browser makes to any website does. Cloudflare uses it to work out which country the visit came from. It is not used to identify you or to build a profile of you, and we never see it. What we see is counts and averages — never a person, and never one visitor's path through the site.

This is separate from advertising. These Cloudflare measurements are not used to choose which ads you see.

Google Analytics

This site also uses Google Analytics 4. Cloudflare tells us how fast the site is. Google Analytics tells us which parts of it people actually use — which guides get read, and whether anyone finds the island. We use it to decide what to fix and what to build next.

This is the tool that uses cookies. It is the reason this site sets any at all. Both of them are listed above, under what is stored in your browser.

Google says that a default Google Analytics setup collects the number of users, session statistics, approximate location, and browser and device information. On this site, that means:

The address and the title of the page you opened, and the site you arrived from, if any.
Roughly where in the world you are. Google works that out from your IP address.
Your browser, your operating system, your screen size and your language.
How long you stayed, and which page you opened next.

Google's tag also records a few actions on its own, without us writing any code for them. It notices when you scroll to the bottom of a page. It notices when you click a link that leaves the site, and when you download a file. Google calls that “enhanced measurement”, and it is switched on here. We add no events of our own beyond it.

About your IP address. Your browser sends it to every site it contacts, and this is no different. Google says that in Google Analytics 4, IP addresses “are not logged or stored”, and that hiding them is therefore not needed. Google uses it to work out your approximate location. We never see it.

We do not see individual people in Google Analytics. What we see is counts, averages and totals. No name is attached to any of it, because the site never asks you for one.

Google keeps event-level data associated with cookies and other identifiers for 2 months. It keeps user-level data associated with them for 14 months. New activity resets that 14-month period. This setting does not apply to standard aggregate reports.

This measuring runs on every page of the site. It does not run inside the generator preview box on the front page, because one visit to the front page would otherwise be counted twice.

Google Analytics here is not linked to any advertising account of ours, so these measurements are not used to choose which ads you see. If that ever changes, this page will say so, and the date at the top will change with it.

Advertising and cookies

This site is free and is paid for by advertising. Advertising here is served through Google AdSense. Google and the advertising partners taking part may process information and use cookies or similar technologies to show and measure ads. They do this under their own policies, and subject to the choices you are offered.

Google's advertising code is fetched early, but it is held. The page asks Google for the code and then tells it, in Google's own words, to pause: load, but request no ads and set no cookies. It stays paused until the site knows your age answer and your cookie choice. Only then is it released, and only then can an ad be requested.

This is done that way for a reason. Google's own consent tool is delivered through that same code, so a site that refuses to load it can never show you Google's consent message either. Loading it paused lets that message appear while still guaranteeing that no ad is requested before you have been asked.

What is released, and when, depends on two things. If you look as though you are in the EEA, the UK or Switzerland, nothing is released until you choose — see the next section. Everywhere else, advertising starts and the bar tells you it has, with a control to turn it off.

If you turn advertising off, no ad is ever requested. Not quieter ads — none. The whole site keeps working: you can build characters, save them and export them exactly as before.

In most of the world, turning advertising off also means Google's advertising code is not fetched at all on your next visit. There is one deliberate exception. If you look as though you are in the EEA, the UK or Switzerland, that code is still fetched and still held paused — because Google's own consent message travels inside it, and dropping the code would mean Google could never ask you its question again. It stays paused for the whole visit and no ad is requested. If you would rather nothing were fetched at all, use the "Do Not Sell or Share My Personal Information" link below, which stops everything everywhere.

If you told us you are under 13, ads are never personalised. The site sets Google's non-personalised ads setting for you before any ad is requested, and it does not offer you a way to switch that off. As the section above says, that setting is not Google's "child-directed" setting and this site does not claim to send that one.

Where personalised ads are allowed, that is permission, not a promise. What you actually see still depends on the rules where you are and on Google's own advertising controls, described below.

Google uses cookies to serve ads based on your prior visits to this and other websites. You can read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.
You can review and change your Google advertising preferences, including turning off ad personalisation entirely, at myadcenter.google.com.
Third-party vendors may also serve ads on this site. You can opt out of personalised advertising from participating vendors at aboutads.info/choices or youronlinechoices.eu.

Those three controls are run by Google and by the advertising industry, not by this site. They are about ad personalisation, and they do not cover every kind of consent that advertising can require. Consent that the law requires is handled separately, as the next section describes.

If you are in the EEA, the UK or Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, extra rules apply to advertising cookies and to using your information for personalised advertising.

If you look as though you are in one of those places, nothing that uses cookies runs before you have chosen. Google's advertising code stays paused, Google Analytics is not fetched, and the bar at the bottom of the page asks first. If you do not answer it, nothing is released.

And if you look as though you are in one of those places, ads are not personalised — whatever you chose. The site works this out from your device's time zone. It never asks anyone else where you are, and it does not look up your location from your internet address.

This is deliberately cautious. A time zone is a rough guess, and the site would rather guess "Europe" and show you a less targeted ad than guess wrong the other way. It means you may see non-personalised ads even if you agreed to personalised ones, and even if you are somewhere else entirely.

Google requires sites carrying its ads to use a consent tool it has certified before personalised ads are shown in those countries. The bar on this site is not one of those tools, which is the reason for the rule above.

Google has its own certified consent tool, and this site is set up to use it. It is delivered through Google's advertising code rather than by this site, which is why that code is now loaded early and paused rather than withheld. Where Google's rules call for it and Google's system is set to deliver it, that message may appear before ads are shown. Whether you see one depends on where you are, so it is not something every visitor gets, and it comes from Google's system rather than from this site.

The time-zone rule above is a stand-in, and it is meant to be temporary. It stays in place while this site cannot confirm that Google's own message is reaching visitors. When it is confirmed, the rule will be removed and this section will be updated to say so.

Declining does not restrict your use of the site. You can still build characters, save them and export them.

Language

This site is published in English and Spanish. Which one you see is decided by your own browser's language setting, which your browser already sends to every site you visit. This site does not use your IP address or your location to choose which language you see, and does not use them to build a profile of you. That describes what this site itself does; the companies involved in delivering the site and its advertising have their own policies, linked on this page. If your browser asks for Spanish while you are on an English page, you are offered a link to the Spanish version once. You can accept it or dismiss it, and either answer is remembered in your browser so you are not asked again.

The English pages are the authoritative version. Where a translation and the English text disagree, the English text is the one that applies.

Artificial intelligence

Because AI comes up a lot with tools like this one, here is exactly where it is and is not involved.

Nothing you make is sent to an AI service. There is no AI model running on this site and no request leaves your device to one. Your characters are built and saved entirely in your browser.
Your characters and their names are not AI-generated. They are made by ordinary procedural code — random picks from fixed lists of shapes, colours and word parts that ship with the page. The same code with the same choices always produces the same result. No model, no training data, and nothing is generated on a server.
Some of this site was written with AI assistance. Parts of the site's code and written text, including the guides and the Spanish translation, were drafted with the help of an AI assistant and then reviewed and edited by a person before publishing. The site's characters, artwork and generated names are original and are not copied from any existing character or brand.
Your data is not used to train anything. We do not collect your creations, so there is nothing to train on. Advertising is handled by Google and its advertising partners under their own policies, linked above.

Your choices

Delete everything this site stored: clearing your browser's site data for this domain removes your saved characters, pet positions and age answer, and the two Google Analytics cookies with them. Your saved characters cannot be recovered afterwards, since they exist nowhere else.
Turn off Google Analytics: Google publishes a free browser add-on. It stops Google Analytics collecting anything from your browser, here and on every other site that uses it. It is at tools.google.com/dlpage/gaoptout, and Google says it works in Chrome, Firefox, Safari and Edge. Blocking cookies for this site does the same job, and so does a browser or an extension that blocks trackers. Everything on this site keeps working either way.
Remove individual pets: use the ✕ next to any pet on the island page.
Change your language: use the “Español” link at the top of this page, or the language link at the foot of any page.
Turn advertising or analytics off: open Manage preferences on the bar at the bottom of the page, untick either one and save. If a tool was already running, the page reloads so that it stops.
Change your cookie choices: use the button below. It clears your age answer and your cookie choices together, so the questions are asked again from the start, and the bar comes back.
Stop advertising and analytics without being asked again: use the Do Not Sell or Share My Personal Information link at the foot of any page. Neither is loaded after that.

Who is responsible for your data

The data controller is the individual operating "Makoto Dev Experiments", based in El Salvador. That is the person who decides what this site collects and why.

Contact: makotodevgx+contact@gmail.com. This is a one-person project, so there is no data protection officer.

Where your data goes

Google AdSense and Google Analytics are run by Google LLC in the United States. Where advertising or analytics is running for you, data those tools collect may be sent there.

Google says it relies on the EU-US Data Privacy Framework and on Standard Contractual Clauses for those transfers. Both are legal mechanisms for moving data out of Europe. This is Google's arrangement, not one this site negotiated, and Google's own privacy policy is the place it is described in full.

Cloudflare serves this site from whichever of its data centres is nearest to you, so the pages themselves may be delivered from any country.

Your rights

If the GDPR or the UK GDPR applies to you, you have these rights over personal data about you:

To see it — ask what is held about you.
To correct it — have anything wrong put right.
To delete it — ask for it to be erased.
To limit its use — ask that it be kept but not used.
To take it with you — get a copy in a form you can move elsewhere.
To object — say no to it being used, including for advertising.

To use any of these, email makotodevgx+contact@gmail.com.

There is one thing worth knowing first. This site has no accounts and no database. Nothing here identifies you, so in most cases there is nothing to look up. Everything the site keeps is in your own browser, and clearing your browser data for this site deletes all of it at once — which is faster than asking us, and does not need our help.

For data held by Google, Google is the one holding it. Their controls are linked in the advertising and analytics sections above.

If you think your data has been handled badly, you can complain to the data protection authority where you live.

California privacy rights

This site does not sell personal information for money. Under California law, showing personalised advertising can still count as "sharing".

If you live in California, you can opt out using the Do Not Sell or Share My Personal Information link at the foot of every page. It takes one click, it needs no account and no email, and it takes effect at once. After that, neither advertising nor Google Analytics is loaded on any page.

The link is available to everyone, wherever you live.

Keeping it safe

This site is static files. There is no login, no database and no server that takes in anything you make. That removes most of the ways a site can leak data, because there is very little held to leak.

Every page is served over HTTPS, so the connection between your browser and the site is encrypted. Cloudflare provides that.

Your characters are saved in your own browser and never sent anywhere. The main risk to them is not us — it is losing them by clearing your browser data. Download the .glb file for anything you want to keep.

If something does go wrong and data is exposed, a notice will be posted on this site, and anyone affected will be told where the law requires it.

Changes to this policy

If this policy changes, the date at the top of the page will change with it. That includes anything important about how advertising here works.

Contact

Questions about this policy or about data on this site can be sent to: makotodevgx+contact@gmail.com

← Brainrot Creator