Privacy policy

Who we are

The operator of heartfall.org can be reached at contact@heartfall.org. This policy covers pages on that domain.

What actually loads

The HTML queues a Consent Mode v2 default before anything else: ad_storage, ad_user_data, ad_personalization, and analytics_storage are denied, with ads_data_redaction and url_passthrough set. Google Analytics 4 is the only measurement product here. Its tag loads from www.googletagmanager.com with measurement ID G-73KYJPJH0P, and the config command runs once with allow_google_signals and allow_ad_personalization_signals off. Until you press Accept that tag stays in the denied state and stores nothing of its own; Accept sets all four choices to granted, which lets the analytics cookie live 180 days with no automatic refresh, and Reject keeps every choice denied.

No AdSense, Adsterra, Clarity, or other session-replay script is injected, before or after a choice. Fonts and video thumbnails are served from this site. An explicit play action loads Google's YouTube privacy-enhanced player at www.youtube-nocookie.com. Playback may also contact Google's youtube.com, ytimg.com, googlevideo.com, ggpht.com, google.com, and doubleclick.net services for player assets, media, security, or advertising. These are YouTube service domains, not additional site analytics installations. Rejecting optional site storage does not prevent a video you explicitly request.

The video provider receives your IP address, browser information, and the URL/referrer necessary to deliver playback, and may use its own cookies or storage. Google operates YouTube under its privacy policy. No video request occurs just by visiting one of our pages or accepting our banner. Cloudflare Pages is the deployment host and Cloudflare Email Routing forwards messages sent to the contact address; hosting and email processing are distinct from browser tracking tags.

Storage, cookies, and retention

Key: hf-consent, in localStorage. Value: a JSON object with choice (granted or denied) and exp, a timestamp 180 days ahead. Purpose: remember your privacy preference, including a refusal. Retention: 180 days, then the script treats the key as missing. Our own script sets no tracking cookie; the only key it writes is hf-consent. Choosing Accept or Reject updates all four Consent Mode preferences. On Accept, Google Analytics 4 is allowed to write its own first-party identifiers on heartfall.org to tell one visit from another, with the 180-day lifetime configured above and automatic refresh off.

If navigator.globalPrivacyControl is true, the script writes denied and does not wait for a click. A Do Not Track signal is not a separate store. With Reject, with no choice saved, or with Global Privacy Control on, analytics_storage stays denied and no analytics cookie is written. Cookie settings in the footer reopens the banner so you can change the stored choice.

Your rights

You can ask for access, correction, deletion, or a copy of any message you sent us, and you can withdraw the stored choice by clearing hf-consent or using Cookie settings. Email contact@heartfall.org. We do not sell personal information. We do not run personalized ads. If you want the industry opt-out pages anyway, they are adssettings.google.com, optout.aboutads.info, and optout.networkadvertising.org.

The host that serves the static files may keep ordinary request logs under its own policy. The one analytics request this site adds is the Google Analytics 4 tag named above, and until you accept it carries no cookie and no advertising signal. Changes to this policy are posted on this page, with a new updated date.

Questions

Related pages