PAPERHEAD

Privacy

Privacy policy

Checked 2026-10-18

This policy matches the scripts that actually ship. I re-read the templates on 18 October 2026 before publishing it.

I searched the built pages for script tags. The only third-party script in the first HTML is Google's gtag.js for GA4 measurement ID G-3YBH0WLC10. Its inline setup calls gtag('consent','default',…) with ad storage, ad user data, ad personalization, and analytics storage set to denied before it calls gtag('config'). YouTube is not in the first HTML.

What loads before you choose

The first HTML loads this site's own CSS, fonts (self-hosted Source Sans 3 and Permanent Marker, no Google Fonts request), and images stored on paperhead.org. It does not load an advertising script or a session recorder. It does load one tag: Google's gtag.js from www.googletagmanager.com, for Google Analytics 4 (measurement ID G-3YBH0WLC10), and that tag starts in consent-denied mode.

A consent default runs before the config call: ad_storage, ad_user_data, ad_personalization, and analytics_storage are denied. ads_data_redaction and url_passthrough are on. If your browser sends Global Privacy Control, I treat that as reject and I do not show the banner.

localStorage

Key ph_consent_v1 stores JSON with your choice (granted or denied) and a timestamp. I keep that choice for 180 days, then ask again. Purpose: remember the choice. Legal basis: consent, and the storage of that preference. You can wipe it with Cookie settings in the footer, or by clearing site data.

I do not run a comment system, an account, or a server log of that key. I cannot see your choice from my side.

YouTube, after accept and a click

Trailer buttons use a picture until you accept and press play. The player then comes from https://www.youtube-nocookie.com/embed/ and the video id. Publisher of those videos is the channel PAPERHEAD THE GAME. YouTube (Google) may set cookies once the iframe exists. Purpose: play the trailer. Legal basis: consent. Retention is Google's, not mine. Reject, or Global Privacy Control, removes the iframe again.

Advertising and analytics

No ad seller is listed in ads.txt. No AdSense, Adsterra, or Clarity project is configured, so those scripts are not injected. Google Analytics 4 (measurement ID G-3YBH0WLC10) counts page views with Consent Mode v2: while analytics_storage is denied the tag sends no analytics cookie and no readable identifier. Accept sets analytics_storage to granted, and then Google may write the _ga cookie (default life 13 months, Google's setting, not mine). Reject, or Global Privacy Control, leaves it denied and no _ga cookie is written. Personalized-ad controls, if you want them for other sites: Google Ads Settings and YourAdChoices. Do Not Track is treated as a preference to leave the denied defaults in place.

Your requests

Email contact@paperhead.org to ask what this policy covers, to object, or to tell me to change a page. I will answer the desk mailbox. I change this policy by editing the page and updating the checked date. Older copies are not a second policy.

Steam screenshot: a cardboard lab with a BIO-FOLD monitor and blood on the tileSteam screenshot: the pencil aimed at a terminal that reads LOCK DOWN equals FALSE

Questions I keep getting

Do you sell data?

No. There is no ad seller. Google Analytics 4 is the only measurement tag, and it stays consent-denied until you accept.

How do I change my mind?

Use Cookie settings in the footer. Reject tears down a YouTube iframe that was already open.

Sources I used