Privacy policy
This policy covers portalsandbox.org. The contact address is [email protected]. It was last updated on 30 Oct 2026. Material changes will be dated on this page.
Default loading, and how to withdraw
We do not require an Accept click before measuring or advertising. If localStorage has no valid choice, the page writes granted and loads Google Analytics 4, Microsoft Clarity and Adsterra on the first view. The banner still appears, so the default is visible and can be withdrawn at any time.
Pressing Reject writes denied to ps_consent for 180 days, sets the GA4 and Clarity consent signals to denied, and reloads the document to stop the running vendor code. Later views do not request them. Pressing Accept reverses that. Cookie settings in the footer reopens the banner. Global Privacy Control and Do Not Track are treated as Reject. The default loading described here is a technical behavior, not evidence of an affirmative consent click. You can withdraw it through Reject or Cookie settings. We do not sell a customer database.
Cookies and local storage
| Name | Where | How long | Why |
|---|---|---|---|
| ps_consent | localStorage | 180 days | Remember Accept or Reject |
| ps_social_closed | localStorage | Until you clear site data | Keep the Adsterra Social Bar closed |
| _ga | Cookie | 2 years | GA4 client identifier |
| _ga_Y5P7TV218D | Cookie | 2 years | GA4 session state |
| _clck | Cookie | 1 year | Clarity user identifier |
| _clsk | Cookie | 1 day | Clarity session stitching |
| CLID | Cookie | 1 year | Clarity / Microsoft identifier |
| MUID | Cookie | 1 year | Microsoft user identifier |
| SM | Cookie | Session | Clarity session |
| Adsterra and partner cookies | Cookie, set by the ad network | Varies by campaign; not independently verified | Frequency capping, measurement, ad personalisation where permitted |
| VISITOR_INFO1_LIVE, YSC, PREF | Cookie, only after you press play | Session to 2 years | YouTube player preferences and security |
Google Analytics 4 (G-Y5P7TV218D)
GA4 runs by default on every page, until Reject, GPC or DNT disables it. It sets _ga and _ga_Y5P7TV218D, reads them on later visits, and sends page views, approximate location derived from the request (Google does not store the IP address for GA4), device and browser details, referrer and interaction events to Google. We do not link this property to a Google Ads account, and we do not upload customer lists.
Event-level data is kept for the retention period configured in the property (up to 14 months); aggregate reports are kept longer. Google acts as our processor under its data-processing terms. You can refuse GA4 with Reject here, or install the Google Analytics Opt-out Browser Add-on so GA4 does not run on any site.
Microsoft Clarity (project z5mo4rfspd)
Clarity records anonymised sessions and heatmaps: clicks, scrolls, taps, page URLs, device and browser, and a first-party identifier. Text typed into form fields is masked by default. It sets _clck (1 year), _clsk (1 day), CLID (1 year), MUID (1 year) and SM (session). Session recordings are kept for up to 30 days and heatmaps plus aggregate metrics for up to 13 months.
Microsoft is the processor for Clarity and its privacy statement applies. Reject sends Clarity consentv2 with analytics and advertising storage denied, reloads the page without the tag to stop collection; later views do not request it.
Adsterra advertising (website 6161522)
We load two Adsterra placements: Native Banner 31996043 (NativeBanner_1) and Social Bar 31996044 (SocialBar_1). No Popunder, Banner or Smartlink is loaded, and adult ads are switched off for this website in the Adsterra panel. GA4 requests use www.googletagmanager.com and www.google-analytics.com. Clarity uses www.clarity.ms, scripts.clarity.ms and regional *.clarity.ms collection hosts. The invoker scripts come from bicea.org and are created by our own loader after the document is parsed, so they do not block the first paint.
Adsterra and its demand partners set cookies and similar identifiers to cap frequency, measure impressions and clicks, and personalise ads where permitted. The names are chosen by the network and can change per campaign, for example a first-party Adsterra user identifier and partner frequency-cap cookies. This site's own code sets none of them. We do not pass your email address or any account data to Adsterra.
You can opt out of personalised advertising at Google Ads Settings, DAA opt-out and NAI opt-out. Adsterra's own policy is at adsterra.com/privacy-policy. Adsterra receives the approximate location and technical data that any ad request carries. Legal basis: consent where required, otherwise our legitimate interest in funding the site.
YouTube, only when you press play
Video buttons use a picture hosted on this site. They do not request YouTube while you are reading. If you press play, the page inserts a player from www.youtube-nocookie.com. That request can set cookies such as VISITOR_INFO1_LIVE, YSC and PREF, and it receives your IP address. YouTube's terms and Google's privacy policy apply from that moment. We do not receive a copy of your YouTube account.
Other third parties
Fonts and game art are files on this site, not calls to a font host. There is no traffic-mesh, banner SDK or other advertising network on the pages. Ordinary host logs (IP address, user agent, URL and time) are kept by the hosting provider to keep the site up and block abuse, on the basis of legitimate interest, for the host's normal log window.
Your rights and how long we keep things
You can ask what this site holds about you, ask for a copy, correction, deletion or restriction, object to processing, or withdraw consent. Email [email protected]. We also process messages you email to us for corrections and support. Messages are retained as needed to handle the request; no fixed retention period is promised. The consent choice is stored in your own browser, so clearing site data removes it and the next visit counts as a first visit again. Vendor-side data is deleted under the retention periods above and the vendors' own request procedures. You can complain to your local data-protection authority. There is no sale of personal information, because we do not collect a customer database.
Sources
- Google privacy policy — GA4 processor terms and retention.
- Google Analytics opt-out add-on — Stops GA4 on every site.
- Microsoft privacy statement — Clarity processing terms.
- Microsoft Clarity privacy — Clarity data and retention.
- Adsterra privacy policy — Adsterra cookies and opt-out.
- Google Ads Settings — Ad personalisation controls.
- DAA opt-out — Industry opt-out.
- NAI opt-out — Industry opt-out.
- YouTube terms — Applies only after you press play.
Questions
Do you load ads and analytics before I click Accept?
Yes. A first visit with no stored choice loads GA4, Microsoft Clarity and Adsterra immediately; the banner tells you and offers Reject. Pressing Reject turns all three off for 180 days.
What does Reject actually do?
It writes denied to ps_consent for 180 days, sets the GA4 and Clarity consent signals to denied, and reloads the document to stop the running vendor code. Later views read the record and do not request them.
Do you honor Global Privacy Control or Do Not Track?
Yes. Either signal is treated as Reject, and the choice is stored for 180 days.