Optional local achievement checklist
The achievement page stores your checkmarks in localStorage under mycopunk-steam-achievements-v1. This functional reminder stays in your browser and is not sent to Steam or synced to an account. Reset checklist removes it; unlike the advertising preference, it has no automatic expiry.
What loads, and when
On a first visit, Google Analytics 4 (G-MGM899Y7PG), Microsoft Clarity (project z29im01m0g) and Adsterra (NativeBanner_1 unit 31884960 and SocialBar_1 unit 31884961) are requested immediately, without waiting for Accept. Missing, malformed or expired preference records mean granted and the banner remains visible until you choose. Accept dismisses the notice; Reject stops these integrations. A saved choice lasts 180 days without being extended by page visits. Existing unexpired rejections remain effective. Cookie settings in the footer reopens the choice.
Global Privacy Control or Do Not Track overrides the default or a saved grant. Accept is unavailable while either signal is active. If localStorage is unavailable, the banner warns that your choice could not be saved for future pages. On withdrawal, a #mp-consent-denied URL fragment preserves denial through the teardown reload of this page only. A new page without that marker defaults to loading integrations again. This fallback is not a 180-day cross-page memory.
The initial HTML contains inert integration settings, not external analytics or ad script tags. The site creates all four loader scripts immediately during the first page view unless rejection or a privacy signal applies. Google Consent Mode v2 initially sets analytics_storage granted and the three advertising fields ad_storage, ad_user_data and ad_personalization denied. Before the GA4 config call, the controller updates all four fields to granted by default, or denied for a rejection or privacy signal. A granted technical signal in this default-load design is not evidence of affirmative legal consent. This notice does not claim that default loading satisfies every jurisdiction's prior-consent requirements.
Google Analytics 4
Unless rejected, Google Analytics 4 (Google LLC) measures page views and engagement for G-MGM899Y7PG, including page URLs, device/browser information and interaction events. The loader uses www.googletagmanager.com; measurements use Google Analytics domains such as google-analytics.com and analytics.google.com. The default first-party cookies are _ga and _ga_MGM899Y7PG, with a two-year lifetime refreshed by subsequent activity, subject to browser limits. Cookie lifetime is not the same as server-side data retention: GA4 property retention is configured separately and has not been verified in this audit. See Google's data retention documentation.
Purpose: count visits and improve pages. The site uses a default-load, opt-out model, not prior opt-in consent. Its legal basis and any applicable prior-consent obligations require separate assessment; this implementation is not a global legal-compliance certification. After a saved rejection, the loader is blocked entirely, rather than merely requesting cookieless measurement. You may also use the Google Analytics opt-out add-on. See Google's privacy policy.
Microsoft Clarity
Unless rejected, Microsoft Clarity (Microsoft Corporation) records heatmaps and session replays of page interactions for project z29im01m0g. It loads from www.clarity.ms and scripts.clarity.ms and sends data to Clarity subdomains. We queue the ConsentV2 signals analytics_Storage granted and ad_Storage granted before loading the tag; these technical default signals are not a claim of affirmative user consent. The documented cookie list includes first-party _clck and _clsk and, depending on the environment, third-party CLID, ANONCHK, MR, MUID and SM. This is a vendor list, not a claim that every cookie appears on this site. See the official Clarity cookie documentation.
Microsoft's retention documentation states 30 days for playback data and 9 months for heatmaps/click data and labeled or favorited sessions. Purpose: find confusing pages. Clarity uses the same default-load withdrawal model, not a prior opt-in gate. Reject stops future loading; withdrawing an existing grant sends a denied signal and reloads the document. See the Microsoft privacy statement.
Adsterra
Adsterra loads by default unless rejected: NativeBanner_1 (unit 31884960) is inserted above the footer and SocialBar_1 (unit 31884961) uses a floating wrapper. The local configuration records publisher 3403020 and website 6144957, with loader URLs on bicea.org. These existing IDs have not been changed. The publisher ID does not independently verify an ads.txt seller ID; no unverified seller authorization is published. This unresolved supply-chain verification does not technically prevent the configured loaders from running.
Purpose: fund this guide through advertising. Ad scripts and their partners may process connection/device information, cookies and identifiers for delivery, frequency control, measurement and personalization. This audit did not establish a complete site-specific cookie inventory or cookie/data retention schedule. The configuration records adult ads as off, but this audit did not verify current account-side filters or live creatives. Adsterra's privacy policy describes its service. Its cookie policy is about the Adsterra website; it is not a verified inventory or retention schedule for this site's ad units. Google Ads Settings and industry opt-out tools do not guarantee control of Adsterra. Reject here stops its loaders. Closing the Social Bar stores mp_socialbar_closed for 180 days and reloads the page to stop its running code; the Native Banner and analytics remain enabled. If storage is blocked, #mp-socialbar-closed preserves that close state for this page's reload only.
YouTube and Cloudflare
YouTube (Google) appears as a local poster. Only after you press play does the page create an iframe to youtube-nocookie.com; the player can then contact Google/YouTube domains and process connection and playback data. Privacy-enhanced mode does not mean no data processing. Play is a separate request, available even after Reject; Reject does not unload an already opened player unless the page reloads. Purpose and basis: provide the video you request by clicking play. See YouTube's embedding documentation and Google's privacy policy.
Cloudflare is configured for this domain's DNS and Email Routing. The 23 Oct 2026 configuration check reported routing ready and the [email protected] forwarding rule active, with no DNS problems. This checks configuration, not delivery to or reading of the destination inbox. We do not add a Cloudflare Web Analytics beacon in the source. Hosting, network and mail providers may process connection metadata and email contents for delivery and security; DNS configuration alone does not establish the current web-hosting path. See Cloudflare's privacy policy.
Local storage and retention
mp_consent_v1 stores version 2, a granted or denied preference after a button choice, an expiry 180 days out, and the banner dismissal flag. No preference record is needed to load integrations by default. Older valid records are also respected. Page visits do not refresh the expiry. The preference value is not transmitted by our consent code. localStorage does not delete itself on expiry: expired records are ignored and can remain physically stored until overwritten or removed. mp_socialbar_closed stores a Social Bar close choice with a 180-day expiry; expired close records are ignored and the bar can load again.
On withdrawal, the site sets the GA4 disable flag, sends denied consent signals, attempts to delete visible first-party _ga, _ga_* and _clck/_clsk cookies at the root path for this host and parent-domain scopes, and reloads if an optional vendor has started. Reloading terminates that document's vendor code; deleting script tags alone cannot do so. We cannot erase third-party or HttpOnly cookies, recall completed requests, or delete vendor-held historical data through this banner. A withdrawal request can itself send a final vendor signal before reload. Use browser controls or contact the relevant provider for additional deletion.
There is no sign-in or contact form in this static site's source. Emails you send contain your address and message and are processed to answer your request. Inbox deletion schedules and actual vendor-account retention settings were not verified by this source/configuration audit; we do not promise an automatically enforced 24-month email limit.
Your rights and changes
Email [email protected] to request access, correction, deletion, restriction or portability, or to object, as applicable. You can withdraw optional analytics consent through Cookie settings and complain to your local data-protection authority. Withdrawal does not undo processing that already occurred. The current analytics/advertising design is default-load with withdrawal, not verified affirmative consent. Essential delivery, security and responses to your email serve the operation of the site and your request. Applicable legal bases and international transfer safeguards require assessment beyond source inspection. Providers may process data internationally under their own terms and safeguards. This page describes the source configuration checked on 23 Oct 2026, not a claim that a new build has been deployed or that vendor dashboards and inbox retention were independently audited.