Privacy Policy · legal-pages/v1 draft
Privacy, plainly.
No tracking on kids. No personalized ads. No third-party scripts running before you decide to press play. This draft adapts the EXC-279 Privacy Policy template for Italian Brainrot's current content/media product.
Template record
Draft pending review.
Template version: legal-pages/v1. Status: draft pending counsel or Brandon review. Operator, privacy contact, retention windows, and final legal contact details must be confirmed before this text is treated as final legal copy.
Information we collect
Minimal by design.
- Email address, signup source, optional character-page context, and an explicit consent flag when a parent or guardian submits the archive-list form. The console provider logs this data in local/default environments; Resend receives it when the approved
resendprovider is configured. - Hosting and diagnostic data such as IP address, user agent, timestamp, requested URL, and error details from Vercel and Sentry when configured.
- HMAC-hashed network source and signup/confirmation target keys, short-lived attempt counters, and a hashed confirmation-token replay guard when the Resend path is configured. Raw email and IP values are not used as store keys.
- Browser-local state such as cookie consent choices and local collection progress after preferences consent. These stay in the visitor's browser and are not account data.
- YouTube/Google embed data only after a visitor clicks play on an embedded video. Until then, the site does not load the third-party player.
What we do not collect
No accounts, payments, or behavioral ads.
Italian Brainrot currently has no account system, no checkout, no payment processor, no personalized advertising, no marketing pixel, and no third-party analytics provider. We do not sell, share, or broker personal information as a customer list.
How information is used
Operate, protect, respond.
Information is used to deliver the site, secure and debug the service, respond to voluntary contact or correction requests, operate the email signup path if enabled, keep family-facing content safe, and comply with legal obligations. Marketing communications require consent and opt-out controls.
Analytics, cookies, and services
Actual providers only.
| Service | Purpose | Data categories | Consent category |
|---|---|---|---|
| Vercel | Hosting, delivery, security, and logs. | IP address, user agent, URL, timestamp, diagnostic metadata. | Necessary |
| Sentry | Application error telemetry when configured. | Error stack, route, browser/device metadata, diagnostic context. | Necessary reliability telemetry |
| Resend | Double-opt-in confirmation and archive-list email delivery when configured. | Email address, contact ID, consent status, confirmation message metadata. | Necessary for the visitor-requested email service |
| Configured Redis-compatible REST store | Rate-limit and confirmation-replay store for the Resend path. | HMAC-hashed source/target keys, counters, and hashed token replay keys with expiry. | Necessary security |
| YouTube / Google | Click-to-load embedded video playback. | Embed/player data after click; controlled by YouTube/Google. | Preferences / third-party embed after action |
| Italian Brainrot localStorage | Cookie consent choices and local collection progress. | Browser-local state; no account identifier. | Necessary and preferences |
See the Cookie Policy for the detailed cookie and provider inventory.
Children's privacy
Family-facing by design.
Italian Brainrot is a family-facing content/media site. Videos may be marked Made For Kids where appropriate under YouTube's framework. The website does not knowingly collect personal information from children under 13. If you believe a child has sent personal information, contact the project through the YouTube channel so a human can review and delete it where required.
Non-essential analytics and marketing cookies remain disabled for child-directed experiences unless counsel or Brandon approves a different policy.
Retention and choices
Browser controls apply.
Browser-local state lasts until the visitor clears browser storage or withdraws preferences consent. Resend confirmation links expire after 24 hours. Pending contacts remain unsubscribed; confirmed contacts remain until they unsubscribe or are deleted under the approved retention process. Security counters expire after one or 24 hours, depending on the limit, and replay keys expire with the confirmation token. Hosting, Sentry, YouTube, Resend, and the configured store also apply their provider settings and policies. Visitors can reopen Cookie preferences in the footer, unsubscribe from any email, and request correction or deletion through the public YouTube contact path until a dedicated privacy contact is approved.
Legal gate
Draft only.
This policy is a product-specific draft and not a final legal commitment. It must be reviewed before public legal publication, and it must be updated before adding new analytics, marketing, account, payment, upload, contest, or email-provider behavior.
