Privacy policy

This policy describes the site's integration code and the first-visit hosts and storage reported during testing on 23 October 2026. It does not claim that continuing to browse gives valid consent or that provider account retention settings have been verified.

Who operates this site

The Midnight Walk Guide is an independent editorial website, not MoonHood or Fast Travel Games. Contact its operator at [email protected] about this policy or your data. There is no account, checkout, newsletter or contact form.

Providers and requests

The 65-page first-visit test observed bicea.org, www.googletagmanager.com, www.google-analytics.com, www.clarity.ms, scripts.clarity.ms and Clarity collection hosts a.clarity.ms, b.clarity.ms, e.clarity.ms, f.clarity.ms, g.clarity.ms, h.clarity.ms, i.clarity.ms, j.clarity.ms, k.clarity.ms, l.clarity.ms, n.clarity.ms, o.clarity.ms, q.clarity.ms, r.clarity.ms, s.clarity.ms, t.clarity.ms and u.clarity.ms. Collection subdomains rotate under *.clarity.ms. Advertising and video providers may use additional delivery domains; this observed list is not an exhaustive record of their downstream processing. Links to stores and sources are ordinary links, not embedded store trackers.

Default requests, OK and Reject

The banner is a default-on notice, not a prior-consent gate. With no valid saved choice, GA4, Clarity and Adsterra start before interaction. OK records that they should remain on. Reject asks the running integrations to stop, disables GA4, removes their loader tags and reloads the page so already-executed third-party code is unloaded. Subsequent pages do not start these integrations while the refusal remains valid. Data already transmitted cannot be recalled, and a request already in flight may complete.

Google Consent Mode v2 is initialized before GA4 configuration: ad_storage, ad_user_data and ad_personalization start denied; analytics_storage starts granted; ads_data_redaction is true. With no saved choice the Google advertising signals remain denied, even though the separate Adsterra and Clarity integrations load by default. OK updates Google signals to granted; Reject updates all four to denied. These technical signals do not themselves establish a lawful basis or prevent unrelated providers from requesting data.

Cookie settings in every page's footer reopens the choices. Reject does not disable essential page delivery, email you choose to send, or a YouTube video you independently choose to play. Global Privacy Control and Do Not Track are not automatically interpreted by this implementation; use Reject or browser tracking protection. Closing the Social Bar hides that placement but does not reject other integrations.

Cookies, local storage and retention

• tmw_consent_v1 in localStorage stores version, ads/replay/analytics flags and a timestamp only after OK or Reject. It is valid for 180 days; expired records are ignored and removed when next read. The first visit does not create an accepted-choice record. A sessionStorage copy supports the current tab if persistent storage is unavailable; session storage ends with the browser session. Delete both copies to reset the choice.
• tmw_social_bar_closed in localStorage stores a closed flag and timestamp for up to 180 days. This only remembers that the Social Bar was closed.
• GA4 may use first-party _ga and _ga_<identifier> cookies for browser/session measurement. Cookie lifetime and account-level event retention are separate provider settings; this audit has not verified this property's configured retention. No specific account-level retention period is promised here.
• Clarity may use _clck, _clsk and provider identifiers such as CLID and MUID. Exact cookies, masking and retention depend on browser behavior and provider configuration. Consult Microsoft's current cookie and privacy documentation; this page does not promise an unverified recording or heatmap retention period.
• Adsterra controls its advertising cookies and storage. During the first-visit test, localStorage extendedvaluekey had the value 'not-provided'. This is a provider-controlled key, not the site's consent record; its purpose, expiry and complete downstream storage inventory have not been established. No lifetime is invented for it or for unobserved advertising cookies.
• YouTube may use cookies and local storage once its player loads, including YSC, VISITOR_INFO1_LIVE, PREF or other provider-controlled keys depending on browser and account state. These names are examples, not a claim that every key was observed on this site; provider policies govern their lifetimes.
• Reject does not automatically erase existing provider cookies or storage. Clear data for this site and, if needed, the relevant provider domains using your browser settings. This site cannot read or erase another origin's cookies. Clearing the saved refusal makes the next visit default-on again.
• If both localStorage and sessionStorage are blocked, the banner reports that the choice cannot be saved. Without a reload that can retain the refusal, already-executed third-party code cannot be guaranteed stopped; enable site storage and Reject again or use browser tracking protection. Session-only storage cannot guarantee a 180-day refusal across sessions.
• Contact emails remain in the operator's mailbox while needed to handle the request and any necessary legal or security follow-up. Provider logging and retention are governed by their policies; no independently unverified fixed deletion deadline is promised.

Legal basis and international processing

Continuing to browse is not affirmative consent. Where GDPR, ePrivacy or local law requires prior consent for non-essential measurement, replay or advertising, a default-on notice and later opt-out are not a substitute. This implementation does not provide a jurisdiction-specific prior-consent gate and must not be described as universally GDPR-compliant. The operator must establish an applicable legal basis and any required prior-consent mechanism before using these integrations in those jurisdictions. OK cannot retroactively authorize earlier requests.

Page delivery, security and responding to correspondence may be necessary for operating the site or responding to your request, subject to applicable law. Providers may process data outside your country, including the United States. Applicable transfer safeguards and recipient arrangements must be checked against the provider terms; this page does not certify account-specific SCC or Data Privacy Framework coverage. The site has no checkout or data-broker service, but advertising disclosures may qualify as sale or sharing under some laws; no blanket exemption is claimed.

Your rights and contact

Depending on your jurisdiction, you may request access, correction, deletion, restriction or portability, object to processing, or complain to a data-protection authority. Email [email protected] with the page, approximate date and request details; avoid sending unnecessary sensitive data. The operator may need proportionate information to identify the relevant data, and provider-held information may also require a request to that provider. Policy changes are dated on this page.