Privacy Policy for Brush Nooli

Brush Nooli ("we", "us", "our") operates the website at brushnooli.com and the free browser game known as Brush Nooli — a viral cat brushing browser game also referred to as the red light green light cat game, ginger cat simulator, and don't wake the cat game. This Privacy Policy describes how we collect, use, and share information when you visit the site or play the game.

By using Brush Nooli, you agree to the practices described in this Privacy Policy. This policy works alongside our Disclaimer and applies worldwide to anyone who plays the game from any country.

Information you provide voluntarily

• Contact form submissions (name, email, message) — only if you write to us.
• Optional feedback you send by email or through social channels.

Information collected automatically

• Device and browser data: browser type, operating system, screen size, and language.
• Approximate location at country / region level, derived from IP address.
• Usage data: pages viewed, referrer, session duration, and aggregate gameplay events such as start, pause, and game over.
• Network data: IP address (truncated where possible) and request timestamps for security and abuse prevention.

Information stored on your device

• High score and last-played settings stored locally in your browser (localStorage). This data never leaves your device unless you contact us with it.
• Cookies and similar technologies — see Section 4 below.

We use the limited information described above to operate the game, keep it secure, and improve the player experience.

• Provide the cat brush game online and keep gameplay running smoothly.
• Diagnose bugs, prevent abuse, and protect the service from automated attacks.
• Measure aggregate audience trends so we can prioritize new features and levels.
• Respond to your messages, support requests, and privacy rights requests.
• Comply with legal obligations and enforce our Disclaimer.

Cookies are small text files placed on your device by a website. Brush Nooli uses two categories of cookies and similar storage.

Strictly necessary

Required for the site and game to function — for example, remembering whether you closed a banner or which device size to render. These cannot be disabled.

Analytics and advertising

Set by us or by third-party providers (such as Google) to measure usage and to deliver and measure ads. You can refuse these cookies through your browser settings or the consent banner where it is shown.

Most browsers let you block or delete cookies through their settings menu. Disabling cookies will not break the core gameplay, but some features (e.g. saved high score) may not persist.

We use Google AdSense and may use other ad networks to display relevant ads. These third parties may use cookies and device identifiers to serve and measure ads, including based on your visits to this and other websites over time. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and other sites on the Internet.

• Google AdSense — ad serving and measurement (Google LLC, USA).
• Google Analytics or similar — aggregate analytics (Google LLC, USA).
• Hosting and CDN providers — required to deliver the page to your browser.

You may opt out of personalized advertising by visiting Google's Ads Settings, the Network Advertising Initiative opt-out page, or YourAdChoices. Links to these tools are available in the Related Reading section below.

We use privacy-respecting analytics to understand how people discover and play the game. Analytics events are aggregated and do not identify individual players. We do not combine analytics data with contact form submissions to build profiles.

• Analytics: retained in aggregated form for up to 26 months.
• Server logs: retained for up to 90 days for security investigations.
• Contact form messages: retained for up to 24 months, then deleted.
• Local high scores: stored on your device only, until you clear browser storage.

• Right to access — request a copy of any personal data we hold about you.
• Right to rectification — ask us to correct inaccurate information.
• Right to erasure — ask us to delete your personal data.
• Right to object or restrict — limit how we process your data.
• Right to data portability — receive your data in a portable format.
• Right to withdraw consent — at any time, with no penalty.
• California residents: right to know, delete, and opt out of any "sale" or "sharing" of personal information under CCPA / CPRA.

To exercise any right, email us through the Contact page. We will verify your request and respond within 30 days as required by GDPR (and within 45 days as required by CCPA).

Brush Nooli is rated suitable for general audiences but is not directed at children under 13. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that is the digital-consent age). If you believe a child has provided personal data, please contact us and we will delete it.

Brush Nooli is operated globally and is hosted on infrastructure in multiple regions. By using the site, you understand that your information may be processed in countries other than your own, including the United States. Where required by law, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms.

We protect Brush Nooli with HTTPS encryption, hardened hosting on Vercel, restricted administrative access, and routine dependency updates. No method of transmission over the Internet is 100% secure, so we cannot guarantee absolute security — but we treat any security report seriously and respond promptly.

We may update this Privacy Policy to reflect product changes, new regulations, or feedback. The "Last Updated" date at the top of the page always reflects the current version. Material changes will be highlighted on the homepage or via an in-game notice for at least 14 days before they take effect.

Questions about this Privacy Policy, or wish to exercise a privacy right? Reach the Brush Nooli privacy team through the Contact page. We respond to every legitimate request within 30 days, and faster wherever we can.