Back to the fortune cookie generator
Privacy Policy
A plain-English account of what this site does and does not collect, who it shares anything with, and the choices you have. No accounts, no advertising, and no cookies set by us.
- Effective
- Last updated
Who this policy covers
This policy explains what happens to information when you use fortunecookiegenerator.app. It covers this website only. If you follow a link somewhere else, or share a fortune into another app, that destination's own policy applies instead.
The site is operated under the name Fortune Cookie Generator. It is a free novelty tool with no accounts, no sign-up, and nothing to buy. You can reach a person at hello@fortunecookiegenerator.app.
The site is intended mainly for visitors in the United States. See the international section near the end if you are reading from elsewhere.
What information is collected
Information falls into three groups.
Information you give us directly. Only the contact form collects anything, and only if you choose to use it: your email address, your message, the topic you select, and your name if you fill that optional field in. Nothing else on the site asks you for personal information, and the fortune you type into "Write your own fortune" is never transmitted anywhere.
Information collected automatically. Loading any web page sends technical information to the server: your IP address, the page requested, the date and time, the referring page, and details your browser reports about itself such as device type and screen size. If analytics is active for you, Google Analytics also records which pages you view and which features you use.
Information from third parties. None. We do not buy, rent, or receive personal information about you from data brokers, advertising networks, or any other outside source, and there is no account to enrich.
Why this information is used
- To deliver the site and keep it working.
- To protect it against abuse, spam, and automated attacks.
- To answer you when you write to us.
- To understand in aggregate which pages and features people use, so we can decide what to improve.
- To meet legal obligations, or to establish or defend legal claims, if that ever becomes necessary.
Information is not used to build a profile about you, to make automated decisions about you, or to advertise to you.
Analytics
We use Google Analytics 4 (measurement ID G-TVW5W0C04S) to understand how the site is used. It may collect the pages you view, an approximate location derived from your IP address, information about your device and browser, the page that referred you, and the actions you take on the page, such as cracking a cookie or copying a fortune. It does not receive the text of any fortune you write.
Whether it runs depends on where you are. In the European Economic Area, the United Kingdom, and Switzerland, the Google Analytics script is not loaded and no analytics cookie is set unless you accept it in the banner. Declining loads nothing at all. Everywhere else, including the United States, analytics starts when the page loads, and you can turn it off at any time using "Privacy choices" in the footer, which stops collection and deletes the analytics cookies.
To tell those regions apart, the browser asks our own server which consent rule applies. That request stays on this domain, is answered from information Cloudflare already has about where the request came from, and returns only which rule applies rather than your location. If it cannot be determined, we assume consent is required and ask.
Google's advertising features are switched off for this property. Google Signals and ad personalisation are disabled, so the measurement is not used to build advertising audiences. Data is retained by Google for two months for both event data and user data, which is the shortest period Google offers, with the setting that would restart that countdown on each return visit turned off. Aggregate report totals, which are not tied to you, are kept by Google separately.
Google acts as our processor for this measurement under its Ads Data Processing Terms, which we accepted on 21 January 2025. We have not enabled the setting that would let Google use this data to improve its own products.
Hosting, delivery, and security
The site is hosted and delivered by Cloudflare, which also provides its security and content-delivery layer. Serving any page necessarily involves Cloudflare processing connection information, including your IP address, in order to route the request and to protect the site against attacks and abuse. Depending on how that protection is configured, Cloudflare may set strictly necessary cookies for security purposes.
We do not run our own web server and we keep no access logs of our own. Cloudflare's own analytics product is switched off for this site, so we receive no visitor measurement from it.
The contact page additionally loads Cloudflare Turnstile, a challenge that checks you are not an automated script. It runs only on that page and is designed to work without tracking people between websites.
Advertising and affiliate links
This site currently carries no advertising and no affiliate links. Nothing on the page is sponsored, and we earn no commission from anything you click.
Space is reserved in the layout for advertising in future. If that ever changes, this section will describe the arrangement before any advertising code runs, and the consent and opt-out mechanisms described below will be updated to match. Advertising typically involves categories of partner such as advertising networks, affiliate programmes, and measurement providers.
Your choices
- "Privacy choices" in the footer turns analytics on or off at any time. Turning it off stops collection and deletes the analytics cookies.
- Your browser can block or delete cookies and site data. Everything here keeps working with cookies blocked.
- Google offers its own opt-out for Analytics through a browser add-on, which works across every site that uses it.
- Favourites and your analytics choice live only in your browser. Clearing site data for this domain removes them, and using a private window normally discards them when you close it.
- You do not need an account to exercise any choice, because there are no accounts.
Privacy rights for United States residents
Several states, including California, Colorado, Connecticut, Virginia, Texas, Oregon, and others, give residents rights over personal information. Depending on where you live and whether the law applies to this site, those may include the right to know what is collected, to access a copy, to have it corrected or deleted, to opt out of sale, sharing, targeted advertising, or profiling, and to appeal a decision you disagree with. You may not be treated differently for exercising any of them.
To make a request, email hello@fortunecookiegenerator.app and say what you are asking for. No account is required, and email is a valid channel for any request. An authorised agent may submit a request for you with proof of authority.
Because this site holds no account and no directly identifying information, we usually cannot connect what little we hold to a named person. Where that is true, the honest answer to an access or deletion request is that we hold nothing we can link to you, and we will say so rather than ask for identity documents we do not otherwise need. Where we can verify a request without collecting extra information, we will.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in state privacy laws. There is no advertising technology on this site, and the analytics that does run has advertising features switched off. If this ever changes, an opt-out will be offered before it does.
Do Not Track and browser opt-out signals
Global Privacy Control is honoured. If your browser sends that signal, analytics is treated as refused everywhere in the world, not only in regions that require it: the script is never loaded, no analytics cookie is set, and you are not shown a banner asking you to reconsider. Clicking "Privacy choices" will confirm the signal was received.
The older "Do Not Track" header is a separate, unstandardised signal, and browsers apply it inconsistently. We do not treat it as a distinct instruction. In practice this makes little difference, because there is no advertising or cross-site tracking here to switch off, and Global Privacy Control is honoured.
How long information is kept
Retention depends on the type of record and why it exists.
- Analytics data is retained by Google for two months for both event data and user data, which is the shortest period Google offers, with the setting that would restart that countdown on each return visit turned off.
- The "_ga" cookie typically lasts about two years from your last visit, unless you delete it or turn analytics off, which expires it immediately.
- Contact messages are kept for up to 60 days after your question is resolved, then deleted.
- Favourites and your analytics choice remain on your own device until you clear them. We hold no copy.
- Connection and security information handled by Cloudflare is retained under its own schedule; we keep no logs of our own.
Some records may be kept longer where that is necessary for security, backup, fraud prevention, or to comply with a legal obligation or resolve a dispute.
Security
We use reasonable administrative, technical, and organisational safeguards appropriate to a site of this kind. The site is served over HTTPS and is built as static files with no application database, no login system, and no store of user data on our side, which removes whole categories of risk. Anything you save stays on your own device.
No method of transmitting or storing information is completely secure, and we do not claim otherwise. We cannot guarantee that information will never be intercepted or accessed without authorisation.
Children's privacy
This site is a general-audience novelty. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the contact form, write to us and we will delete it.
Visitors outside the United States
This site is intended primarily for visitors in the United States. It is not marketed to, or localised for, any other country.
If you use it from elsewhere, your information may be processed in the United States or in other countries where our service providers operate, and the privacy laws there may differ from those where you live. Visitors in the European Economic Area, the United Kingdom, and Switzerland are asked for consent before any analytics runs, as described above.
Changes to this policy
This policy was last updated on 2026-07-19 and applies from 2026-07-19. If what the site does changes in a way that materially affects you, the policy will be updated before the change takes effect and the date above will change with it. Changes are not applied retroactively to information already handled under an earlier version.
Contact
Questions, requests, and complaints all go to the same place: hello@fortunecookiegenerator.app. There is also a contact form on this site if you prefer. A person reads everything that arrives.