Who is responsible
The guide at flam.run is operated independently. The contact for privacy requests is [email protected]. There is no separate legal entity named on this page, and I am not inventing a street address. Requests about a Steam purchase go to Valve, not to this mailbox.
What loads when you open a page
The HTML, the stylesheet, the fonts, and the images are served from flam.run. Four third parties can be reached, and three of them start on the first page view: Google Analytics 4 (measurement ID G-15NTWQLNFJ), Microsoft Clarity (project zbsxqhh2ow), and Adsterra (publisher 3403020, website 6191174). The fourth is YouTube: a video stays as a picture and a play button until you press play, and only that press creates a youtube-nocookie. player. Steam links are ordinary links; they do not embed the store. There is no AdSense, no Cloudflare Analytics beacon, and no other tag.
This is the default-load model: with no saved choice, and with no Global Privacy Control or Do Not Track signal, the page writes “granted” and starts all three vendors immediately; the banner then appears as a notice with an OK and a Reject button. Reject is a real off switch: it stops further GA4 collection, tells Clarity to stop, removes the Adsterra tags, and the choice is remembered for 180 days. Nothing on the site is held back behind an Accept click.
Google Analytics 4
GA4 loads from www.googletagmanager.com and sends measurement to www.google-analytics.com (including regional endpoints), on page views without a saved rejection, with Consent Mode v2 defaults: analytics_storage is granted from the first byte, while ad_storage, ad_user_data and ad_personalization stay denied, with ads_data_redaction and url_passthrough set. GA4 writes its own first-party cookies _ga and _ga_15NTWQLNFJ (up to 2 years) and reports page views, sessions, and approximate location derived from your IP address. Reject disables GA4 collection, denies all four consent signals, and reloads the page; the saved rejection then prevents the GA4 loader from running. Google’s policy: policies.google.com/privacy. Opt out of measurement with the GA opt-out add-on.
Microsoft Clarity
Clarity (project zbsxqhh2ow) records heatmaps and anonymised session replays: clicks, scroll depth, and page layout. It is loaded by a small first-party loader that creates the www.clarity.ms/tag/ script in the page; its script delivery and collection can also use scripts.clarity.ms and regional *.clarity.ms hosts. the served HTML contains no clarity.ms <script src>. Clarity sets first-party cookies code>_clck (1 year) and _clsk (1 day), and may store a CLID identifier, to group a visit into one recording. Form input is masked by Clarity’s default settings. Reject calls Clarity’s consent API with both storage signals denied and reloads the page to end the current recording; the saved rejection prevents its loader from running again. Microsoft’s policy: privacy.microsoft.com/privacystatement.
Adsterra advertising
Advertising is served by Adsterra, an independent ad network (publisher 3403020, website 6191174). Two placements are live: the Native Banner, ad unit 32204731, in a labelled Advertisement box inside the page, and the Social Bar, ad unit 32204732, a bar fixed to the bottom-right edge of the viewport with a Close ad bar button. Adult advertising is switched off for this website in the Adsterra dashboard, and no Popunder, Banner, or Smartlink unit is created or loaded.
Where the code comes from: both snippets are served from bicea.org (bicea.org/21/e834257c… for the Native Banner, bicea.org/14/0784ab7d… for the Social Bar). The URLs exist as strings in the page; the script tags are created by the site’s own loader on the first view, so no ad request blocks the first paint and no <script src> to an ad host appears in the HTML. Adsterra and its creative partners may set cookies or browser storage on their own domains (not on flam.run) to cap frequency, measure impressions, and choose a creative; those names and lifetimes are set by Adsterra, not by this site, and are described in its policy. Reject removes both snippets and hides the fixed bar.
Personalised-advertising opt-outs: Adsterra’s privacy policy, DAA opt-out, NAI opt-out, Your Online Choices (EU/UK), and Google Ads Settings. Blocking bicea.org in your browser also works; no part of the page depends on the ads. ads.txt declares one seller only: adsterra.com, 3403020, DIRECT.
YouTube after you press play
A video is a local picture until you press play. The press creates a youtube-nocookie.com frame, and YouTube can then contact Google-operated player, media, and image services (including youtube.com, googlevideo.com, and ytimg.com), receive your IP address and browser details, and set its own storage. A privacy-enhanced frame is not third-party-free playback. Reject does not disable the play button; the click is your instruction to load that one player.
Keys stored in this browser
| Key | Purpose | How long | Legal basis |
|---|---|---|---|
| flam_consent | Remembers OK or Reject from the banner, or a Global Privacy Control / Do Not Track signal. | 180 days | Necessary to honour your choice (Art. 6(1)(c) and ePrivacy Art. 5(3) exception). |
| flam_social_bar_closed | Remembers that you pressed Close ad bar, so the Adsterra Social Bar stays away. | 180 days | Your choice, stored so the bar does not return on reload. |
| flam_ach_checks | Which FLAM EVAW achievements you ticked on the checklist. Never sent to a server. | Until you clear site data | A convenience you turn on by ticking a box. |
Vendor cookies are separate: GA4 and Clarity can set first-party cookies on flam.run as described above, while advertising partners may use their own domains. The vendor identifiers include: GA4 (_ga, _ga_15NTWQLNFJ), Clarity (code>_clck, _clsk, CLID), and Adsterra (names chosen by Adsterra on bicea.org and its creative hosts). This site writes no advertising or analytics identifier of its own.
Legal basis and retention
The site relies on its legitimate interest in measuring and funding an independent guide (GDPR Article 6(1)(f)) for the default GA4 measurement and the two Adsterra placements, with the default-load and rejection behaviour described above; pressing OK records your choice to continue, and Reject withdraws it. Clarity session recording follows the same default load and stops on Reject. The consent and ad-bar choices expire after 180 days; the achievement checklist remains until you clear site data. Vendor cookies follow the vendors’ own schedules, linked above. Hosting connection-log retention is controlled by the hosting provider.
Your rights
You can ask for access, correction, deletion, or a restriction, and you can object, by emailing [email protected]. Because the site has no account, deletion usually means clearing the keys above in your browser. You can also complain to a supervisory authority where you live. This guide does not sell personal information. Use Cookie settings in the footer to reopen the banner and change the stored choice at any time; clearing site data for flam.run removes the choice and the banner asks again.
Logs, children, and changes
The host that serves the files may keep ordinary connection logs for security. This site does not add its own analytics on top of GA4. The guide is written for a general audience and is not directed at children. If the set of third parties changes, this page changes in the same edit, and the date at the top moves with it. Older aliases /privacy-policy/, /cookie-policy/, and /cookies/ redirect here.