Privacy policy
MCrafter is run from Victoria, Australia. This policy explains what we collect, why, who else sees it, and how to get it deleted. It is written to satisfy the Australian Privacy Act, the GDPR for visitors in the EU and UK, and Google's requirements for sites that show AdSense ads. Last updated 5 September 2026.
Short version
The tools run in your browser and don't send your images or skins anywhere. We only hold personal data if you create an account. Ads and the AI skin generator involve third parties, described below.
What stays on your device
Every tool processes images, skins and designs locally in your browser. Files you drop into a tool are not uploaded to our servers unless you press "Save to my account". Your theme choice (light or dark) is kept in your browser's local storage. Share links encode the design in the link itself; nothing about you is stored with them.
Accounts
If you sign in we store: your email address; the display name and avatar your sign-in provider (Google, Discord or Apple) shares with us; and the creations you choose to save, which are a small settings file and a PNG image. Sign-in, the database and file storage are provided by Supabase. A session token is kept in your browser's local storage so you stay signed in; it is not an advertising identifier. Saved creations are stored until you delete them or your account. You can delete individual creations from the Account page and request full account deletion by emailing us; we complete deletion within 30 days.
AI skin generation
When you use the AI option in the AI Skin Generator, your text prompt is sent to our server and passed to Anthropic to design the skin. We don't store prompts. To prevent abuse we keep a per-day request counter keyed to your IP address (or, if signed in, to your session token) for 25 hours, after which it expires. Don't put personal information in prompts.
Analytics
We use Cloudflare Web Analytics, which does not use cookies, does not fingerprint devices and does not track you across sites. Cloudflare also serves the site and, like any host, sees IP addresses and request logs for security and performance.
Advertising and cookies
We show ads through Google AdSense and may add other ad networks. Google and its partners use cookies and similar technologies to serve ads, measure them and, where you have consented, personalise them based on your visits to this and other sites. You can read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. To opt out of personalised advertising, use Google Ads Settings or aboutads.info. Visitors in the EU, UK and Switzerland see a consent prompt before any advertising cookies are set and can change their choice at any time from the "Privacy settings" link in the footer. Apart from advertising, this site sets no cookies.
Who we share data with
Only the providers named above, each for the purpose stated: Supabase (accounts and saved creations), Anthropic (AI prompts), Cloudflare (hosting, analytics, rate limiting) and Google (advertising). We don't sell personal data and we don't share it with anyone else unless the law requires it.
Where data is held
Our providers operate globally; account data and saved creations are stored on Supabase servers in Seoul, South Korea (AWS ap-northeast-2), and AI prompts are processed in the United States. By using the account features you agree to this transfer.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] and we will respond within 30 days. If you are in the EU or UK you also have the right to complain to your local data protection authority; in Australia, to the Office of the Australian Information Commissioner.
Children
MCrafter is a general-audience site. The tools work without an account. We don't knowingly collect personal data from children under 13, and account sign-up requires you to be 13 or older (16 in some countries) or have a parent's permission. If you believe a child has created an account, email us and we will remove it.
Security
Traffic is encrypted with HTTPS. Account data is protected by row-level access rules so only you can read your creations unless you share them. No system is perfectly secure; keep your sign-in provider account protected.
Changes
If we change this policy in a way that matters, we will update the date above and, for account holders, note it on the Account page.