Privacy policy

What loads, and when

Three third parties start with the first page view, without waiting for a click: Google Analytics 4 (property G-L6FB9B1NKN), Microsoft Clarity (project z5p4z9lbzf) and Adsterra (publisher 3403020, website 6161854). The cookie banner on a first visit is a notice, not a gate. It tells you what is running and gives you two buttons: Accept keeps the default, Reject stops all three and remembers that refusal for 180 days.

The scripts are not written into the HTML as blocking tags. The page stores their addresses as strings and creates the tags itself after the document is parsed, so an ad or a session recorder never delays the first paint. That is a performance choice, not a consent gate: with no saved choice the tags are created on that first view.

YouTube is the one exception. The trailer is a picture until you press Play; only then does the page create a player frame on the youtube-nocookie host. If you never press it, that host is never contacted. Outbound links to Steam, YouTube channels or a publisher site are ordinary links and run nothing until you choose them.

There is no traffic-mesh or other banner SDK on this site, no account system, no newsletter, and no sale of personal data.

Google Analytics 4

GA4 counts page views and basic engagement: the page address, referrer, approximate location derived from the IP address, device and browser type, and a random client id. IP addresses are not stored in the reports. Analytics storage is granted by default so the property records visits; the advertising signals (ad_storage, ad_user_data, ad_personalization) stay denied until you press Accept, and Reject switches analytics off as well.

Google Analytics 4 writes two first-party cookies on drawquarium.org: _ga, which holds the random client id and lasts up to 2 years, and _ga_L6FB9B1NKN, which keeps the session state and lasts up to 2 years. Event data in the GA4 property is kept for up to 14 months. Google acts as our processor; its own handling is described at https://policies.google.com/privacy.

Microsoft Clarity

Clarity records how the pages are used: clicks, scroll depth, taps, and a reconstruction of the page as you saw it, together with the browser, screen size and country. It is used to find layout problems such as a button that is hard to hit on a phone. Typed text in form fields is masked by Clarity before it leaves the browser, and this site has no form that would collect a password or a payment detail.

Clarity writes the cookies _clck (12 months, the visitor id) and _clsk (1 day, the session id), and may read Microsoft cookies such as MUID and ANONCHK on the clarity.ms and microsoft.com domains. Clarity keeps a session recording for 30 days, then a sample of about 1% (or ten recordings a day, whichever is larger) for up to 9 months. Microsoft describes its own processing at https://privacy.microsoft.com/privacystatement.

Adsterra

Adsterra fills two placements: a Native Banner inside the article flow and a Social Bar pinned to the corner of the screen. The ad frame is served from the network's own domain (bicea.org and the Adsterra domains) and can set its own cookies there to cap frequency, measure a click and avoid showing the same creative twice. Those cookies are third-party cookies on the ad domain, typically kept for up to 1 year, and this site cannot read them.

Adsterra does not run pop-under, interstitial or adult creatives on this site. Adult advertising is switched off on the publisher account. The Social Bar has a close button; closing it writes dq_socialbar_closed for 180 days so it does not return on the next page.

You can limit personalised advertising from the industry pages at https://optout.aboutads.info/ and https://www.youronlinechoices.com/, and Google's own controls at https://adssettings.google.com/. Microsoft's privacy dashboard at https://account.microsoft.com/privacy covers Clarity and the Microsoft cookies above.

The keys this site writes

The site writes exactly two keys of its own, both in localStorage and both on drawquarium.org. They are never sent to an ad network as a profile; they only tell this page whether to run the tags and whether you closed the bar.

dq_consent holds the choice (granted or denied), the date it was made and an expiry 180 days later. On a first visit with no key the page writes granted and then shows the banner, so pressing nothing keeps the default; pressing Reject overwrites it with denied and reloads the page once to tear the tags down. If the browser exposes Global Privacy Control, the page writes denied instead and does not wait. The Cookie settings button in the footer reopens the banner at any time.

dq_socialbar_closed holds {closed: true} with the same 180-day expiry when you close the Social Bar. Accept clears it, because an explicit Accept is the one action that should bring the bar back.

Why this is allowed, and what you can ask for

For visitors in the European Economic Area and the United Kingdom the legal basis is consent (GDPR Article 6(1)(a) and the ePrivacy rules): the banner records your choice, and Reject withdraws it for the three vendors at once. Withdrawing does not affect the lawfulness of what ran before you pressed it. Elsewhere the basis is our legitimate interest in measuring and funding a free guide (Article 6(1)(f)), which the same Reject button lets you override.

Email you send to [email protected] is read to answer the message and kept only as long as the thread needs. You can ask for a copy or deletion of that correspondence, ask what the analytics property holds about your visit, or object to the processing, by writing the same address. The site has no account, so there is no profile to export beyond the identifiers listed above.

A material change to this policy shows a new date at the top of the page and a new paragraph here; the old statement is replaced, not hidden.

Questions people ask

Keep going