Home › Privacy
Privacy · Updated 2026-10-24
Privacy policy
This policy matches the scripts on bloodborne.org as of 24 October 2026. Analytics, session replay and advertising load on your first visit. A banner tells you what runs and lets you reject; a rejection is remembered for 180 days and switches those scripts off.
I listed every third party the pages actually load, including the ones that run before you touch the banner. Fonts are files on this site, not a Google Fonts request. The consent code is inline and runs from this domain.
Default loading and your choice
The site loads Google Analytics 4, Microsoft Clarity and Adsterra advertising on the first page view, without waiting for a click. The banner is a notice and a withdrawal control, not a gate. Choose Reject and the site records denied in localStorage, sends denied consent signals and reloads the page to stop the running analytics, session-replay and advertising code. Later page views do not request those scripts while that record is valid. Choose Accept, or use Cookie settings in the footer, to turn them back on.
If Global Privacy Control is on in your browser, the site records denied and does not load those scripts. Do Not Track is not used as a consent signal by itself.
- localStorage key bb_consent_v1 holds {choice, exp}; retention 180 days; purpose is to remember Accept or Reject.
- The banner appears on the first visit and whenever the 180-day record has expired.
- Reject never blocks the page: editorial content, fonts and images are served from bloodborne.org.
Google Analytics 4
Measurement ID G-9X782FLK49. GA4 receives page views, approximate location derived from the request, device and browser details, and interaction events. GA4 may set _ga (default 2 years) and _ga_9X782FLK49 (default 2 years) to distinguish visitors and persist session state. This site does not load Universal Analytics or intentionally set its _gid cookie. We have not verified a custom event-retention setting for this property; the Google Analytics retention controls apply. Loading is enabled by default under this site's notice and opt-out model. The configured loading behavior is not a claim of compliance with every jurisdiction's prior-consent requirements.
Google acts as a processor. Data may be processed outside your country under Google's safeguards. You can opt out with the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout, and you can block the request with the Reject button.
Microsoft Clarity
Project ID z2ja50s4s7. Clarity records pseudonymous session replays, heatmaps and click/scroll events so I can see which pages fail readers. Microsoft lists _clck and _clsk as first-party Clarity cookies, and CLID, ANONCHK, MR, MUID and SM as possible third-party identifiers. Their use depends on browser settings, region and vendor consent handling; cookie names and expiry can change with the SDK. The current Microsoft cookie list does not specify a project-specific retention setting, so this policy does not invent one. Clarity provides masking controls, but you should not enter sensitive information on a recorded page. Microsoft controls replay retention under its current Clarity terms; we do not promise a project-specific retention period we have not verified. The same default-loading and Reject controls apply to session replay.
Microsoft acts as a processor. See https://privacy.microsoft.com/privacystatement for its handling and retention terms. Reject reloads the page and prevents the Clarity loader from running while the rejection is valid.
Adsterra advertising
Publisher ID 3403020, website ID 6146106. Two units run: NativeBanner_1 (31892834), an in-page native block, and SocialBar_1 (31892835), a fixed bar at the bottom of the viewport. Adsterra and its demand partners may set cookies and read device information to select and measure ads. Those cookies are set by the ad hosts (currently bicea.org and related Adsterra domains); some SDKs may also set first-party state, and their lifetime is controlled by those partners. Adult ads are switched off for this site.
The fixed bar can be closed with the Hide ads button. That writes localStorage key bb_socialbar_closed_v1 with {closed, exp} for 3650 days, so the bar stays closed after a reload. The native block has no separate close control because it sits in the page flow like an image.
Advertising loads by default under the notice and opt-out model described above. You can opt out of personalised advertising at https://www.youronlinechoices.com/, https://optout.aboutads.info/ and https://adsterra.com/privacy-policy/. Reject stops the Adsterra scripts on this site.
Consent signals and vendor hosts
Before any Google config call, ad_storage, ad_user_data and ad_personalization default to denied; analytics_storage defaults to granted and ads_data_redaction is enabled. An unanswered banner permits GA4, Clarity and Adsterra network requests, but does not grant Google advertising storage. Accept updates the signals to granted. Reject updates all four to denied and prevents those loaders on the reloaded page.
Observed initial hosts are www.googletagmanager.com and www.google-analytics.com (Google), www.clarity.ms, scripts.clarity.ms and regional collection subdomains of clarity.ms (Microsoft), and bicea.org (Adsterra). Ad creatives can contact additional demand-partner hosts; these are governed by the Adsterra policy linked below. Fonts and editorial images are served locally.
YouTube
Video cards use locally hosted site illustrations. The thumbnail URL on i.ytimg.com is metadata in structured data and is not requested by the card. The player itself is not embedded until you press play; it then loads https://www.youtube-nocookie.com/embed/ with the trailer ID. On play, YouTube may set its own cookies and process your request under Google's terms (https://policies.google.com/privacy). Reject does not remove a player you started yourself, but the site does not create one automatically.
Hosting and security
The planned hosting uses Cloudflare and a private origin. Cloudflare processes IP addresses and request metadata to deliver the site and stop abuse. It may set __cf_bm (about 30 minutes) for bot management and cf_clearance when a challenge is completed. Cloudflare acts as a processor; see https://www.cloudflare.com/privacypolicy/. No Cloudflare Insights analytics script is loaded.
Local guide progress
Boss, trophy and walkthrough checklists store only the checked item IDs on this device, using localStorage keys bloodborne.tools.bosses.v1, bloodborne.tools.trophies.v1 and bloodborne.tools.walkthrough.v1. These progress records have no automatic expiry and remain until you use the checklist's clear control or clear this site's storage. The tool code has no progress-upload API, account sync or third-party dependency. Separately, the analytics and session-replay services described above can observe tool interactions while enabled; choose Reject to turn those services off. The build planner, weapon filters, map selection and ending chooser compute locally without their own saved input records. Reject does not disable these functional tools.
Retention, rights and contact
The consent record lasts 180 days. The social-bar close record lasts 3650 days or until you clear site data. Checklist progress has no automatic expiry. Analytics and advertising retention is set by Google, Microsoft and Adsterra as described above. You can request access, correction or deletion of mail you sent us. Use Cookie settings then Reject to withdraw; deleting the consent record returns this site to its default-loading first-visit state.
Write to [email protected]. If you are in the EEA or UK you may also complain to your local data-protection authority. Policy changes are posted on this page with a new updated date.
Questions
Do I have to accept anything before reading?
No. The page loads immediately. Analytics, Clarity and ads also start on the first view; the banner explains that and Reject turns them off for 180 days.
Does advertising share device data?
Adsterra and its demand partners may receive device and usage information to select and measure advertising. Reject disables these scripts. The site does not promise that vendor data sharing falls outside every legal definition of sale or sharing.
How do I withdraw consent?
Press Reject on the banner, or open Cookie settings in the footer and then Reject. Reject reloads the page to stop running scripts and applies to later page views for 180 days. Clearing the consent record instead restores default loading on the next visit.