Privacy Policy
Last updated 2026-07-26
The simulation runs entirely inside your browser, and nothing you do here is ever transmitted or stored. Every neuron, every spike, every region you click and every parameter you move exists only in your own device's memory. There is no account, no login, no database, no backend server, no form, no upload, no analytics, no cookie and no tracking pixel. Close the tab and all of it is gone. There is nowhere for it to have gone instead.
That is the whole story, but a policy that only says "we collect nothing" is usually not telling the truth, because a website still has to be delivered by a host. Below is the honest version: what exists, who has it, and why.
1. Everything happens on your device
CEREBRUM is a set of static files. Your browser downloads them once and then does all the work itself, on your own graphics card. There is no server behind the page listening for anything, because there isn't a server at all beyond the file host. No interaction you have with the simulation is sent anywhere, recorded, or seen by us. We could not retrieve it if we wanted to.
The page does read three things from your browser, once, at startup: how many CPU cores it reports, roughly how much memory it reports, and whether the user-agent string looks like a phone. It uses them to choose a neuron count your hardware can carry in real time. Those values are read in JavaScript, used in JavaScript, and never transmitted.
The site does not request access to your camera, your microphone, or your location. There is no code in it that asks for any of them, and it ships a Permissions-Policy header that switches off geolocation and the motion sensors at the browser level as well.
2. What is collected, and why
Nothing is collected by the site itself. Three ordinary web mechanics generate records elsewhere, and here is each one in full.
- Host request logs — Cloudflare Pages. What: your IP address, your browser's user-agent string, the file you requested, the time, and the response code. Why: this is what any web host records in order to hand a file to a browser and to defend itself against attacks and abuse. Who holds it: Cloudflare, as the host. We have no analytics dashboard, we do not receive per-visitor logs, and we do not look at them.
- Font requests — Google Fonts. The page loads three typefaces from fonts.googleapis.com and fonts.gstatic.com. Making that request exposes your IP address and user-agent string to Google, as any request to any server does. We send them nothing else and no identifier of any kind.
- Library request — unpkg. The Three.js graphics library loads from unpkg.com, a public code CDN we do not control. Same exposure: your IP address and user-agent string reach that CDN.
That is the complete list. There are no cookies, no analytics of any kind, no accounts, no advertising networks, no tracking pixels, no Meta Pixel, no session replay, no A/B testing, no fingerprinting, and no email collection. Nothing on this site profiles you or follows you anywhere else.
3. The three outside services
Cloudflare hosts the files. Google serves the fonts. unpkg serves the Three.js library. Each of them handles the data described above under its own privacy policy, not ours, and we have no access to what they hold.
If you would rather not contact them, you can block those origins in your browser or with an extension. The page will fall back to your system fonts and still look reasonable. Three.js is required for the 3D view, so blocking unpkg will stop the simulation from starting.
4. Cookies and local storage
The site sets no cookies, and none of the three services above sets a cookie for it. Your browser will cache the files and fonts so the page loads faster next time, which is normal caching, not tracking.
If a future version remembers a display preference — a simulation speed, say — it would use your browser's local storage, which is a small store on your own computer that is never sent anywhere. You can clear it at any time: in Chrome or Edge, open the padlock icon in the address bar and choose the site-data option, or use Settings and clear browsing data for this site; in Firefox, use Settings, Privacy and Security, Manage Data. Clearing it costs you nothing but the preference.
5. We do not sell or share anything
We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not give or trade it to data brokers, advertisers, or anyone else. This has never happened and cannot happen, because the site never receives anything to sell.
6. How long anything is kept
The site stores nothing, so it retains nothing and there is nothing on it to delete. Your simulation state lives in your device's memory and is discarded the moment you close the tab. The host and CDN request logs described in section 2 are kept by those companies on their own schedules, which we do not control and cannot shorten.
7. Children's privacy
The Terms ask that you be 13 or older to use the site, in line with the Children's Online Privacy Protection Act. We do not knowingly collect personal information from children, and we do not knowingly collect it from adults either — the site is built so that there is nothing to collect from anyone. If you are a parent or guardian and still have a concern, email us and we will answer honestly.
8. California rights
The California Consumer Privacy Act gives California residents the right to know what personal information a business has collected about them, to have it corrected or deleted, to opt out of its sale or sharing, and not to be treated worse for asking.
Applied here, honestly: we hold no personal information about you. There is no profile, no record, no identifier, and no account, so there is nothing to disclose, correct, or delete, and no sale or sharing to opt out of. If you ask, this is the answer you will get. The only personal-information-adjacent data that exists anywhere is the IP address in the host and CDN logs from section 2, held by those companies for delivery and security. Requests about those must go to them.
9. EU and UK rights
Under the GDPR and UK GDPR you have rights of access, rectification, erasure, restriction, objection, and portability, and the right to complain to your data protection authority.
Applied here: the site itself processes no personal data, so most of those rights have nothing to act on. The one processing that does occur is the IP address recorded in server logs when a file is delivered, which rests on the legitimate interest of running a website and defending it from abuse. There is no profiling and no automated decision-making. Files are served from whichever CDN edge is nearest to you, which is how a static site is delivered rather than an intentional transfer of your data.
10. Changes to this policy
If this policy changes, the revised version appears on this page with a new date at the top. There is no mailing list, because we have no way to contact you, so that date is the notice. If the site ever starts collecting anything at all, this page will say so plainly and in advance.
11. Contact
Privacy questions, or anything above that you want explained: neilsgupta@outlook.com.
12. About this document
This policy was written by the person who built CEREBRUM. It was not drafted or reviewed by a lawyer, and it is not legal advice to you. It is a plain, accurate account of how a static educational page handles data, which in this case is by not handling any.
Back to CEREBRUM