Privacy policy

What loads before you choose

The first HTML loads this site's own CSS, fonts (self-hosted Source Sans 3 and Permanent Marker, no Google Fonts request), and images stored on paperhead.org. It does not load an advertising script or a session recorder. It does load one tag: Google's gtag.js from www.googletagmanager.com, for Google Analytics 4 (measurement ID G-3YBH0WLC10), and that tag starts in consent-denied mode.

A consent default runs before the config call: ad_storage, ad_user_data, ad_personalization, and analytics_storage are denied. ads_data_redaction and url_passthrough are on. If your browser sends Global Privacy Control, I treat that as reject and I do not show the banner.

localStorage

Key ph_consent_v1 stores JSON with your choice (granted or denied) and a timestamp. I keep that choice for 180 days, then ask again. Purpose: remember the choice. Legal basis: consent, and the storage of that preference. You can wipe it with Cookie settings in the footer, or by clearing site data.

Key ph_adbar_v1 stores a timestamp only, written when you press Hide ad bar. I keep it for 90 days so the fixed ad bar is not requested again on your next visit. Purpose: remember that you dismissed it. Legal basis: your request, plus my legitimate interest in not nagging you.

I do not run a comment system, an account, or a server log of those keys. I cannot see your choice from my side.

YouTube, after accept and a click

Trailer buttons use a picture until you accept and press play. The player then comes from https://www.youtube-nocookie.com/embed/ and the video id. Publisher of those videos is the channel PAPERHEAD THE GAME. YouTube (Google) may set cookies once the iframe exists. Purpose: play the trailer. Legal basis: consent. Retention is Google's, not mine. Reject, or Global Privacy Control, removes the iframe again.

Ads from Adsterra, after accept

I monetize the content pages with Adsterra (adsterra.com), publisher account 3403020. Two units are created for paperhead.org in the Adsterra dashboard, website 6130703, both approved there: Native Banner (unit NativeBanner_1, id 31787168), an in-page widget that fills a labelled Advertisement slot under the article, and Social Bar (unit SocialBar_1, id 31787169), a bar the network pins to the bottom of the page. I switched Adsterra's adult-ads option off for this site, so adult creatives are not served.

Both unit scripts come from bicea.org, the host Adsterra serving uses. They are not in the HTML the server sends: my page code builds the two script tags in JavaScript and only does so when the banner choice is granted, so Reject, Global Privacy Control, or no choice at all means no request to bicea.org and no ad. Purpose: show ads and pay for the writing. Legal basis: consent, and my legitimate interest in funding the site. Adsterra pays me; I do not sell anything to Adsterra and I do not receive your data back from it.

What Adsterra keeps: a cookie on its own host bicea.org named pip_ followed by a hash, which identifies a browser for frequency capping, fraud checks and measurement. The one I saw in a cookie jar, pip_2db5466f2e8180fa430e3d8b142c88dc, carried an expiry roughly a day after the visit that wrote it, so treat it as a short-lived frequency-capping id rather than a long profile; the rest of Adsterra's retention is theirs, not mine. Every ad call also carries page URL, IP address, user agent, and a referring URL. Adsterra's retention and transfer terms are in its privacy policy and cookies policy. Ads may be personalized by Adsterra and its demand partners; the exits are Adsterra's opt-out and contact route, YourAdChoices, Your Online Choices, and Google Ads Settings for Google-served creatives. I read this domain's cookie jar on the live site on 18 October 2026: the only cookies there were Google Analytics _ga / _ga_3YBH0WLC10 and Clarity _clck / _clsk, none from the ad host.

The Social Bar sits over the bottom of the page, so I reserve space for it in the page padding, keep it inside the viewport width, and give you a Hide ad bar button. Hiding it stores ph_adbar_v1 in localStorage for 90 days and the bar is not requested again until that expires, including after a reload. The in-page Native Banner stays put: it does not float and it covers nothing.

Advertising and analytics

ads.txt lists Adsterra as the only authorized seller: adsterra.com, 3403020, DIRECT. Adsterra's help centre says the network does not require an ads.txt file and does not publish a seller id, so that line carries the publisher id from my own Adsterra account and nothing else. I would rather publish one verified line than guess at others. No AdSense, no other network, and no ad unit outside the two named above runs here.

Google Analytics 4 (measurement ID G-3YBH0WLC10) counts page views with Consent Mode v2: while analytics_storage is denied the tag sends no analytics cookie and no readable identifier. Accept sets analytics_storage to granted, and then Google may write the _ga cookie (default life 13 months, Google's setting, not mine). Microsoft Clarity (project yz9iclpmm6) is the session recorder: its loader stays dormant until the same Accept, and then it reads page URLs, clicks, scrolling, and device or browser details and Microsoft may set the first-party cookies _clck (up to 1 year) and _clsk (up to 1 day) on this domain. Reject, or Global Privacy Control, leaves analytics denied, records no session, writes neither cookie, and requests no ad. The Google consent signals for ads (ad_storage, ad_user_data, ad_personalization) stay denied at all times, because this site runs no Google ad product; Adsterra is gated at script level instead. Do Not Track is treated as a preference to leave the denied defaults in place.

Your requests

Email [email protected] to ask what this policy covers, to object, or to tell me to change a page. I will answer the desk mailbox. I change this policy by editing the page and updating the checked date. Older copies are not a second policy.

Questions I keep getting

Sources I used

• YouTube no-cookie player — Loaded only after consent and a click
• Adsterra privacy policy — The ad network named above, publisher account 3403020
• Adsterra cookies policy — Retention and cookie categories for the ad host bicea.org
• Google ad settings — Personalized-ad exit for Google-served creatives
• YourAdChoices — US opt-out for interest-based advertising