Privacy
Privacy policy
This policy describes candykingdomdefense.net, a fan guide to the Roblox game Candy Kingdom Defense. The operator publishes this domain and can be reached at [email protected]. The page was checked on 23 October 2026 against the scripts that actually ship in the build.
The site uses a default-on model. If your browser has no valid choice stored and Global Privacy Control is off, the first page view is treated as granted: Google Analytics 4, Microsoft Clarity and Adsterra load immediately, the notice is shown, and the choice is stored as granted. Pressing Reject turns those three off and remembers the refusal for 180 days. There is no sentence elsewhere on this site saying that ads or analytics wait for an Accept click.
Third parties that run on this site
| Vendor | What it does | When it loads | Data it can receive |
|---|---|---|---|
| Google Analytics 4 (gtag.js, measurement id G-DQ36BW304E) | Aggregate page views, sessions, referrers and engagement; Consent Mode v2 is configured before the config call. | First page view by default. Reject switches analytics_storage to denied and reloads without loading gtag.js. Previously sent requests cannot be recalled. | Page URL, title, referrer, approximate location derived from IP, device/browser, and a client id stored in first-party cookies. |
| Microsoft Clarity (project id z24fwkpv33) | Heatmaps, session replay and click/scroll analytics. Clarity masks sensitive content by default. | First page view by default. Reject reloads the document without Clarity; the loader does not create the script on later visits. | Pages viewed, clicks, scrolls, device/browser, a Clarity user and session id, and masked interaction data. |
| Adsterra (publisher 3403020; website 6144092) | Native Banner NativeBanner_1 (unit 31879004) and Social Bar SocialBar_1 (unit 31879005). Adult ads are off. | First page view by default. The native slot and the fixed Social Bar are created by this site's loader; Reject removes the ad scripts and hides the bar. | Ad requests, IP address, user agent, page URL, cookies or local storage set on Adsterra and bicea.org domains, and demand-partner signals used for delivery, frequency capping and measurement. |
| YouTube (youtube-nocookie.com) | Plays a cited guide video in a privacy-enhanced iframe. | Only when you press the play button on a video card. There is no YouTube iframe in the initial HTML. | IP address, device/browser, the video requested, and YouTube cookies once the iframe or player loads. |
Cookies, localStorage and retention
The keys below are the stable names this site controls or observes. Adsterra and its demand partners can add creative- and partner-specific names on their own domains; those are listed here by vendor rather than as a frozen list because the auction changes them.
| Key or cookie | Set by | Purpose | Retention |
|---|---|---|---|
| ckd-consent (localStorage) | This site | Stores {choice, ts} where choice is granted or rejected, so Reject survives reloads and is not asked again. | 180 days, then the next visit writes a fresh granted record and shows the notice. |
| ckd-adsterra-floating-closed (localStorage) | This site | Stores the timestamp when you close the Adsterra Social Bar, so the fixed bar does not come back on reload. | 180 days. |
| _ga | Google Analytics 4 | Distinguishes browsers for aggregate measurement. | 2 years. |
| _ga_DQ36BW304E | Google Analytics 4 | Keeps GA4 session state for this measurement id. | 2 years. |
| _clck | Microsoft Clarity | Stores the Clarity user id. | 1 year. |
| _clsk | Microsoft Clarity | Groups page views into a Clarity session. | 1 day. |
| MUID | Microsoft | Microsoft user id used by Clarity and other Microsoft services. | Up to 1 year. |
| Adsterra and bicea.org cookies/localStorage | Adsterra and demand partners | Ad delivery, frequency capping, fraud prevention and measurement. Names vary by creative and partner. | Per Adsterra and partner policies, generally up to 1 year. |
| YSC, VISITOR_INFO1_LIVE, PREF | YouTube | Playback preferences, embedded-player security and view measurement after you press play. | Session to about 8 months. |
Legal basis and your choices
- This build uses the default-on notice described above, not a claim that browsing is affirmative consent. Privacy requirements vary by jurisdiction; this notice does not certify that default-on nonessential storage meets every jurisdiction's consent rules. Reject disables the vendor scripts and Cookie settings lets you change the choice.
- Global Privacy Control is honored: when navigator.globalPrivacyControl is true, the site stores rejected and does not load the three scripts. Do Not Track is not a reliable signal in every browser and is not used as the switch.
- Reject is not buried: the button is next to Accept on the banner, and Cookie settings reopens the same choice from every page. Reject applies to GA4, Clarity and Adsterra; YouTube remains click-to-load in all cases.
- For personalized advertising opt-outs, use Google Ads Settings at https://adssettings.google.com, the industry pages at https://www.youronlinechoices.com and https://optout.aboutads.info, and Adsterra's privacy policy at https://adsterra.com/privacy-policy/. Clarity and Microsoft choices are described at https://privacy.microsoft.com.
- You can ask for a copy or deletion of any email you send us, or object to processing, by writing to [email protected]. We do not hold an account database. Email is routed through Cloudflare Email Routing; no marketing list is built from it.
Contact, children and changes
The site is a general-audience game guide and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child sent us personal data, write to [email protected] and we will delete it.
We may update this policy when a vendor or key changes. The checked date at the top of the page changes with the policy, and the new text replaces the old one on this URL. The contact address for privacy requests is [email protected].
Sources
- Google Analytics privacy — Google's own data practices.
- Microsoft Clarity privacy — Clarity's privacy and data collection information.
- Adsterra privacy — Adsterra and demand-partner practices.
- YouTube privacy — Applies after a video is played.
Questions
Does the site load analytics and ads before I press Accept?
Yes. A first visit with no stored choice is treated as granted, so Google Analytics 4, Microsoft Clarity and Adsterra start on the first page view. The banner is a notice with a Reject button, not a gate. Reject stops them and is remembered for 180 days.
What happens when I press Reject?
The site stores rejected in ckd-consent, sends a denied update to Google Analytics, hides the ads and reloads the page to discard running vendor scripts, frames and timers. The new page creates none of the three vendor scripts. Requests already sent cannot be recalled. Cookie settings in the footer can change the choice back.
How long is my choice remembered?
180 days in localStorage under ckd-consent. The Adsterra fixed-bar close choice uses ckd-adsterra-floating-closed for the same 180 days. After expiry the next visit starts from the default-on state again.
Do you sell personal data?
No. We do not operate an account database or a contact form. Adsterra and its demand partners may process cookie and device data to deliver and measure ads; their own policies and opt-outs are linked below.