Privacy policy

What loads, and what does not

Pages are static. Nunito is self-hosted with the site, so a page view does not call Google Fonts. The first response loads two third-party scripts: the Google tag from www.googletagmanager.com and the Microsoft Clarity loader from www.clarity.ms, which Clarity answers with its SDK on scripts.clarity.ms. An inline snippet sets Consent Mode v2 defaults before the tag is configured, so ad_storage, ad_user_data, ad_personalization, and analytics_storage all start as denied, with ads_data_redaction and url_passthrough on. It then configures Google Analytics 4 with Measurement ID G-ZVKSKKSLJP. While analytics_storage is denied, the tag sets no analytics cookie and sends only a cookieless ping, which the property's reports do not count. Accepting in the banner grants analytics_storage; rejecting keeps it denied and the tag stays cookieless. No advertising script is in that first response either: the ad code described below is created in the browser only after your choice.

Microsoft Clarity records sessions and builds heatmaps for project yyqnh7vdph. The project runs in Clarity Consent Mode, so before your choice Clarity writes no cookie here and no recording is tied to you; accepting tells Clarity consent is granted and starts recording, and rejecting calls its consent API with a false flag, which deletes any Clarity cookie and keeps the recorder off. Uploads, when enabled, go to *.clarity.ms. Typed input, numbers and email addresses are masked before upload, so keystrokes in forms are not part of a recording. Microsoft may also set its own cookies on Microsoft domains (such as CLID and MUID) once consent is granted, to keep the pseudonymous id that links a recording together.

Advertising comes from Adsterra (adsterra.com), the only ad network on this site, in two placements on Adsterra website 6128117: a Native Banner inside the article column (ad unit 31768955) and a Social Bar strip that attaches itself to the bottom of the viewport (ad unit 31768956). Neither invoker script is in the page HTML. Both are created by this site only after you accept optional storage, and Reject removes what the page already injected, so the ad script host (bicea.org) is never contacted before your choice. Once they run, Adsterra and the advertisers it serves receive your IP address, user agent, referring page and the page URL, and may set their own cookies on this domain or on their own domains to cap frequency and choose ads. Adsterra publishes its cookies policy and privacy policy; it states that it does not provide an automated opt-out tool, so leaving ads unaccepted is the opt-out on this site, and the industry tools at youronlinechoices.com and optout.aboutads.info manage interest-based advertising for the companies that participate in them.

YouTube, a Google service, is the only external embedded media provider. Pressing Play creates a youtube-nocookie.com iframe. Until that click, the poster is hosted on this domain and no video provider is contacted. Privacy-enhanced mode does not mean anonymous playback: YouTube receives your IP address, browser details and playback requests after you load it.

The player can request scripts, playback telemetry, thumbnails, fonts and video from Google-operated domains, including youtube-nocookie.com, googlevideo.com, ggpht.com, gstatic.com, google.com and googleapis.com. These requests belong to the loaded YouTube player, not a site analytics or advertising integration. Rejecting site analytics or ads does not disable a video you explicitly choose to load.

When deployed, Cloudflare serves the site and may process connection information such as IP address, requested URL and security logs. Cloudflare Email Routing forwards mail addressed to contact@overthehill.run to the operator’s Gmail mailbox, provided by Google. Email you send can contain your address and message; sending mail is separate from accepting browser storage.

Storage, time, and your choice

The choice is stored in localStorage under oth_consent_v1 (JSON with choice and timestamp) and oth_consent_at (timestamp string). The site treats it as valid for 180 days; after that, the banner appears again and the next choice replaces it. The browser does not automatically delete expired localStorage. Reject keeps analytics_storage denied, so the Google tag stays cookieless and Clarity keeps its recorder off, and it injects no ad script. Accept grants analytics_storage, which lets the tag write its own first-party cookies on this domain (_ga and _ga_ZVKSKKSLJP, each up to two years) and count the page view, lets Clarity write _clck (its pseudonymous id) and _clsk (which links page views into one recording) on this domain, and loads the two Adsterra scripts, after which Adsterra's own cookie policy applies. One more local key belongs to the ad slot: oth_ads_closed records that you closed the floating Social Bar strip, so it stays closed on later page views, and it is cleared when you Accept again. Cookie settings in the footer reopens the banner; choosing Reject there also deletes Clarity's cookies and removes the ad scripts from the current page.

If the browser sends Global Privacy Control (navigator.globalPrivacyControl), the site applies the rejected state and does not wait for a click. A Do Not Track signal is treated the same way in spirit: we do not run a tracker that would ignore it. We do not sell personal information.

Rights, ads, and changes

You can ask for a copy, a correction, or deletion of any email you sent us. Write to contact@overthehill.run. We keep correspondence only as long as needed to answer it. The legal basis for answering mail is the request you made, and the legal basis for advertising and analytics is the consent you give in the banner. The third parties this site can load are Adsterra (advertising), Google Analytics 4 (page views) and Microsoft Clarity (session recordings and heatmaps); all three stay off until you accept, and Reject withdraws the choice for later visits.

External links such as Steam are destinations, not scripts loaded on a page view. Their services apply their own policies if you leave this site. Policy changes are dated in the updated line on this page. Adding another advertising, measurement or session recording provider requires a matching policy update and consent testing before activation.

Questions

Keep reading

• Contact
• Editorial policy