Privacy Policy

This policy describes beyondthesestars.org as it is built on 19 October 2026. If a script is not listed here, it is not supposed to be on the page. Controller for this site: the editorial desk, contact@beyondthesestars.org.

Settlement buildings beside forests at sunset, Steam store screenshot. © Balancing Monkey Games / Hooded Horse.

Kewa carrying a settlement through space, Steam store screenshot. © Balancing Monkey Games / Hooded Horse.

What loads before you choose

The first HTML requests one third-party script, Google Analytics 4 (gtag.js, measurement ID G-2D8N1DLN89), and it arrives with Consent Mode v2 storage already denied, so no analytics or advertising storage is used before you choose. Microsoft Clarity, a heatmap and session-replay tool, is not requested at all at this point. No ad network and no comment host is requested either: the two Adsterra placements described under Advertising exist only as URL strings in the HTML until you accept. Fonts are the ones already on your device. Game screenshots are files on this host.

Consent choice

Key: localStorage `bts-consent`. Value: a JSON object with choice (`accepted` or `rejected`) and ts (milliseconds).
Retention: 180 days, then the banner can show again.
Purpose: remember whether optional storage may be granted.
Legal basis: consent for optional storage. The record itself is stored so we can honor that choice (legitimate interest in not asking on every page, and consent for the grant).
An inline function named gtag sets Consent Mode defaults before any config call: ad_storage, ad_user_data, ad_personalization and analytics_storage start as denied. ads_data_redaction and url_passthrough are on. The measurement ID is G-2D8N1DLN89, and the config call runs while storage stays denied.
Accept also requests Microsoft Clarity (heatmaps and session replay, project “Beyond These Stars Fan Guide”, ID z06yagyucf) from www.clarity.ms, which then reports to *.clarity.ms. Clarity stores a random first-party cookie and pseudonymous session IDs; it masks form input and other sensitive content by default and does not build a cross-site profile for advertising. Reject does not request it, and Global Privacy Control forces Reject, so Clarity never loads in that case.
If navigator.globalPrivacyControl is true, the choice is stored as rejected and the banner stays down.
Footer “Cookie settings” opens the banner again. Accept and Reject overwrite the key.

YouTube, only after play

Trailer posters are hosted here. Pressing Play separately requests a privacy-enhanced embed from www.youtube-nocookie.com, operated by Google/YouTube. The player may then request video, images and player assets from youtube.com, googlevideo.com, ytimg.com, ggpht.com and Google service hosts such as google.com, googleapis.com, gstatic.com or doubleclick.net. These requests transmit your IP address and browser information; playback can use local storage or cookies under YouTube’s policies. Purpose: deliver the video you requested. Playback does not grant analytics or advertising consent to this site. We do not receive your YouTube watch history. Google privacy policy.

Rejecting optional storage through Cookie settings removes any active trailer and restores its local poster. This stops the current embed; it cannot undo requests already sent to YouTube. You may explicitly request playback again by pressing Play.

Advertising (Adsterra)

Advertising on this site is served by Adsterra, an independent ad network and ad server that sells display inventory for publishers. Nothing is requested from Adsterra until you press Accept: the HTML ships the placement URLs as strings only, and both snippet tags are created by the page's consent handler at that moment. Reject — or Global Privacy Control, which forces Reject — means no ad script, no ad request and no Adsterra cookie at all.

Placements: Adsterra “Native Banner”, ad unit 31816196, in a labelled box under the page body; and Adsterra “Social Bar”, ad unit 31816197, the bar fixed to the bottom edge of the viewport. Adult advertising is switched off for this website in the Adsterra dashboard.
Where the code comes from: both snippets are served from bicea.org (bicea.org/21/… for the Native Banner, bicea.org/14/… for the Social Bar). Any identifier Adsterra sets therefore normally lives on its own domain rather than on beyondthesestars.org; those cookie names and lifetimes are chosen by Adsterra, not by us, and are listed in its own policy. This site writes no advertising identifier of its own.
Our keys on this origin: localStorage `bts-consent` (your accepted/rejected choice and its timestamp, 180 days) and localStorage `bts-floating-ad-closed` (`{"closed": true, "ts": …}`, written when you press “Close ad bar”, 180 days, so the bar stays closed across reloads and later visits). Neither key carries an advertising identifier.
Retention: the two localStorage keys above expire after 180 days; after that the banner asks again and the Social Bar may return. Cookie lifetimes on bicea.org are set by Adsterra and end according to its policy.
Legal basis: your consent (GDPR Article 6(1)(a), and the ePrivacy rules on storing or reading information on your device) for the Adsterra scripts, its cookies and personalised advertising. There is no legitimate-interest fallback for advertising here, and declining costs you no content on this site.
Personalised advertising opt-outs: Adsterra's privacy policy and opt-out at adsterra.com/privacy-policy/, the industry opt-out pages optout.aboutads.info and youronlinechoices.com (EU/UK), optout.networkadvertising.org, and Google Ads Settings at adssettings.google.com. Blocking bicea.org in your browser or an extension also works — no part of the page depends on the ads.
ads.txt declares the seller actually in use: `adsterra.com, 3403020, DIRECT`. No other network, reseller, smartlink or popunder is declared or loaded, and the site runs one ad network only.

Withdrawing an earlier Accept: Cookie settings → Reject stops further ad loading, hides the banner and the fixed bar and clears the reserved space at the bottom of the page, but requests already sent to Adsterra cannot be recalled. The Social Bar comes back on a later visit unless you close it or Reject; closing it is remembered for 180 days under `bts-floating-ad-closed`.

Do Not Track and Global Privacy Control

Global Privacy Control keeps optional storage denied, including if Accept is pressed: the Clarity recording tag is not requested and the Adsterra placements are never injected. We do not read Do Not Track as a consent signal: the gtag.js request still happens, with analytics and advertising storage denied, and the ad scripts stay unloaded until an explicit Accept. A separately requested video can still contact YouTube.

Your rights

Depending on where you live, you can ask for access, correction, deletion, or a copy of the messages you sent us, and you can withdraw consent without affecting earlier lawful processing. Email contact@beyondthesestars.org. You can also clear localStorage for this origin in your browser, which deletes `bts-consent` and `bts-floating-ad-closed`. We do not run a user account system, so there is no profile to export beyond that key and any email you chose to send.