Privacy policy

Who we are

The operator of heartfall.org can be reached at [email protected]. This policy covers pages on that domain.

What actually loads

The HTML queues a Consent Mode v2 default before anything else: ad_storage, ad_user_data, ad_personalization, and analytics_storage are denied, with ads_data_redaction and url_passthrough set. Google Analytics 4 is the only measurement product here. Its tag loads from www.googletagmanager.com with measurement ID G-73KYJPJH0P, and the config command runs once with allow_google_signals and allow_ad_personalization_signals off. Until you press Accept that tag stays in the denied state and stores nothing of its own; Accept sets all four choices to granted, which lets the analytics cookie live 180 days with no automatic refresh, and Reject keeps every choice denied.

Adsterra is the one ad network on these pages: website 6125623, with both ad units Active in the Adsterra dashboard and adult ads switched off for this site. Neither ad tag is in the first render. The page holds an empty container above the footer, and our own script appends the Adsterra Native Banner tag (ad unit 31749953) and the floating Social Bar tag (ad unit 31749954, requested immediately above the closing body tag) only once your choice is granted. With Reject, Global Privacy Control, or an expired choice, no request reaches Adsterra at all. The auction and the creatives are served from bicea.org and other Adsterra delivery hosts, and Adsterra decides which advertiser is shown.

Microsoft Clarity (project yy6cdkpbwk) records sessions and heatmaps for this guide. Clarity has no Consent Mode and writes its own cookies, so its loader is built by our script and called only once your choice is granted; before that no request reaches clarity.ms. Fonts and video thumbnails are served from this site. An explicit play action loads Google's YouTube privacy-enhanced player at www.youtube-nocookie.com. Playback may also contact Google's youtube.com, ytimg.com, googlevideo.com, ggpht.com, google.com, and doubleclick.net services for player assets, media, security, or advertising. These are YouTube service domains, not additional site analytics installations. Rejecting optional site storage does not prevent a video you explicitly request.

The video provider receives your IP address, browser information, and the URL/referrer necessary to deliver playback, and may use its own cookies or storage. Google operates YouTube under its privacy policy. No video request occurs just by visiting one of our pages or accepting our banner. Cloudflare Pages is the deployment host and Cloudflare Email Routing forwards messages sent to the contact address; hosting and email processing are distinct from browser tracking tags.

Storage, cookies, and retention

Keys in localStorage that our own script writes: hf-consent, a JSON object with choice (granted or denied) and exp, a timestamp 180 days ahead, whose purpose is to remember your privacy preference, including a refusal, and its retention is 180 days, after which the script treats the key as missing; and hf_ad_bar_v1, which stores hidden or shown for the floating ad bar you control from the footer, has no expiry, and stays until you press that button again or clear site data. Choosing Accept or Reject updates all four Consent Mode preferences.

On Accept, Google Analytics 4 may write its own first-party identifiers on heartfall.org (_ga and _ga_73KYJPJH0P, up to two years) to tell one visit from another, with the 180-day configured lifetime above and automatic refresh off. Accept also lets Microsoft Clarity write the _clck cookie, which lasts up to a year, and the _clsk cookie, which lasts up to a day, and start recording heatmaps of the pages you open; Clarity records no keystrokes or values typed into form fields, and its masking settings stay at the defaults. Accept also loads the Adsterra tags, after which Adsterra sets its own cookies and storage on this domain: the social bar keys it names after the unit, sb_main_<unit id> and sb_count_<unit id>, which remember the floating bar and how often it appeared, two short random-named cookies its native banner uses for the same purpose, and the localStorage key extendedvaluekey. Those advertising cookies are written by Adsterra, not by this site, and their lifetime is set by Adsterra.

If navigator.globalPrivacyControl is true, the script writes denied and does not wait for a click. A Do Not Track signal is not a separate store. With Reject, with no choice saved, or with Global Privacy Control on, analytics_storage stays denied, the Clarity loader is never injected and no Adsterra tag is appended, so no analytics or advertising cookie from these parties exists. Cookie settings in the footer reopens the banner so you can change the stored choice, and rejected tags are removed again.

Your rights

You can ask for access, correction, deletion, or a copy of any message you sent us, and you can withdraw the stored choice by clearing hf-consent or using Cookie settings. Email [email protected]. We do not sell personal information. Ads here are served by Adsterra under your consent choice: Adsterra runs the auction and is the controller of the advertising data it collects, and this site never sees it. If you want the industry opt-out pages anyway, they are adssettings.google.com, optout.aboutads.info, optout.networkadvertising.org, and youronlinechoices.eu. The footer control labelled Hide ad bar removes the floating Social Bar, and that choice is remembered.

The host that serves the static files may keep ordinary request logs under its own policy. Apart from the tags named above, this site adds no request of its own, and nothing is sent to Adsterra, Clarity, or YouTube until you accept or press play. Changes to this policy are posted on this page, with a new updated date.

Questions

Related pages