Privacy policy
Updated
This policy matches the scripts on the page. We load two measurement tags. Google Analytics 4 counts page views with every storage flag denied, so it writes no analytics cookie. Microsoft Clarity groups page views into aggregate heatmaps and session replays. Adsterra serves two ad placements, and neither script is in the HTML: both arrive only after you accept. A consent stub sets storage to denied before any optional embed.
Who is responsible
The frosthaven.app editorial desk, reachable at [email protected], is the contact for privacy requests. We do not sell personal data.
Scripts and third parties
The first HTML includes an inline function named gtag that records the Consent Mode v2 defaults: ad_storage, ad_user_data, ad_personalization, and analytics_storage are all denied, and that denied state reaches the dataLayer before the tag is configured. The same file then loads googletagmanager.com to run Google Analytics 4 (measurement ID G-W294P163L1) for page counting. Because analytics_storage stays denied even after you allow optional media and ads, the tag sets no _ga cookie, cannot follow you across sites or sessions, and reports only cookieless aggregate page views. ads_data_redaction is enabled. We load no Google Ads or AdSense tag.
Advertising is served by Adsterra (Adsterra Network LP) through the script host bicea.org. Two placements run: a Native Banner (unit 31793262) in the content column and a Social Bar (unit 31793263), the fixed strip at the bottom of the viewport. Neither <script src> is in the HTML we send: both are created by page script only after you press Accept in the consent banner, so a visit that rejects, ignores the banner, or carries Global Privacy Control requests nothing from bicea.org and is served no ad. Adsterra receives your IP address, the page URL, referrer, user agent and viewport, and may set its own cookies on bicea.org or from ad creative loaded by its partners. Adult advertising is switched off at the Adsterra website level, and no popunder or interstitial format runs here. See Adsterra Privacy Policy.
Optional video is provided by Google / YouTube. Accepting alone does not contact YouTube: a subsequent Play click loads a privacy-enhanced player from youtube-nocookie.com. The player can contact youtube.com, ytimg.com, googlevideo.com, ggpht.com and Google-owned delivery endpoints, depending on playback and region. It receives your IP address, referrer origin, device and playback data, and may use browser storage. See Google Privacy Policy.
The player does not receive microphone permission. Rejecting in Cookie settings removes an inserted player and blocks future playback. It cannot undo data already sent to YouTube or erase storage owned by another origin. Expired choices and Global Privacy Control keep optional media blocked.
Google LLC receives the Analytics requests those page views produce: the page path, the referring site, browser language and viewport size, and the IP address, which Google uses for coarse location before discarding it. We set no user ID, send no local notebook or campaign text, and enable no Ads or Signals feature. See Google Privacy Policy and How Google Analytics collects data.
The same head also loads Microsoft Clarity (project yzid7bo0jb) from clarity.ms and scripts.clarity.ms. It records heatmaps and session replays so we can see which guide sections get read. Text you type into form fields is masked by default, and replay never receives your local notebook, campaign notes or hand lines. Clarity drops its own _clck and _clsk cookies and sends the page path, referrer, coarse device and interaction events to Microsoft. See Microsoft Privacy Statement.
Cloudflare Pages is the configured delivery provider for this site; hosting requests may expose your IP address, request path, device headers and security logs to Cloudflare. This does not require an advertising script or a third-party font request. See Cloudflare Privacy Policy. External source and store links contact their destination only when you follow them.
Cookies and localStorage
Google Analytics sets no cookie here, because analytics_storage stays denied. Microsoft Clarity sets its own first-party cookies. Once you accept, the Adsterra script keeps its own cookie state to cap frequency and count impressions; because that script runs inside this page, what it writes is first-party to frosthaven.app. We read the served page on 18 October 2026 and saw it set vrk4n8fqhwc3jzy7pbsmgt6dx5lha2u9 (7 days) and dom3ic8zudi28v8lr6fgphwffqoz0j6c (until the browser closes), plus sb_main_… and sb_count_… for the Social Bar (2 hours). Adsterra owns those names and may change them, so its privacy policy stays the authoritative list. The browser storage keys we write ourselves are listed below. Choice retention is 180 days.
| Key | Purpose | Retention | Legal basis |
|---|---|---|---|
| _clck | Microsoft Clarity visitor ID and settings | 1 year | Aggregate measurement (Clarity) |
| _clsk | Links page views into one Clarity session replay | 1 day | Aggregate measurement (Clarity) |
| fh_consent | Stores accept or reject, plus expiry | 180 days | Necessary to remember your privacy choice |
| fh_ads_closed | Remembers that you closed the Social Bar ad strip | Until you clear site data | Your consent to advertising, plus a necessary local preference |
| vrk4n8fqhwc3jzy7pbsmgt6dx5lha2u9 | Adsterra anonymous session identifier, written by its script after you accept | 7 days | Your consent to advertising (Adsterra) |
| dom3ic8zudi28v8lr6fgphwffqoz0j6c | Adsterra session marker used together with the line above | Until you close the browser | Your consent to advertising (Adsterra) |
| sb_main_… and sb_count_… | Social Bar display state and per-session count; the suffix is the unit key 0cbcb606523854fdfa8b478a5b31725b | 2 hours | Your consent to advertising (Adsterra) |
| fh_campaign | Campaign tracker notes you type | Until you clear site data | Requested local-only functionality |
| fh_hand | Hand notebook lines you type | Until you clear site data | Requested local-only functionality |
Do Not Track and Global Privacy Control
If navigator.globalPrivacyControl is true, we store a denial and do not treat a later accept click as consent. We do not honor a separate Do Not Track header beyond that, because browsers no longer send a reliable DNT signal we can read in page script. The Cookie settings button in the footer reopens the banner.
Your rights
You can ask for access, correction, deletion, or a restriction by emailing [email protected]. We will respond to the address you write from. Local notes never reach us; clear them in your browser. You may lodge a complaint with your local authority. Optional third-party media uses your consent, which you can withdraw through Cookie settings. The privacy-choice record is necessary to remember both acceptance and rejection.
Advertising only loads after you accept, and accepting is what you withdraw by choosing Reject in Cookie settings. Adsterra serves the placements; its opt-out and data-subject routes are described at https://adsterra.com/privacy-policy/. Industry-wide interest-based advertising choices are collected at https://www.youronlinechoices.com/ and https://optout.aboutads.info/. Rejecting leaves bicea.org unrequested, so on this site those links only matter if you accepted earlier.
Changes
When a script is added, this page and the page date change in the same release. The date on this page is 18 October 2026.
Questions
Do you use cookies for ads?
Adsterra loads only after you accept, and it then keeps its own cookie and storage state for frequency capping and impression counting. Until you accept, no ad script exists on the page: the only storage is the fh_consent key in localStorage and the Clarity measurement cookies listed above.
How do I change my choice?
Use Cookie settings in the footer. The banner stores fh_consent for 180 days.
Related guides
Sources
- YouTube privacy-enhanced embeds — Player loads only after acceptance and a separate Play click.