Privacy policy

This policy describes the scripts that actually run on melonsandbox.app in the 29 Oct 2026 build. Google Analytics 4, Microsoft Clarity and Adsterra are requested on the first page view, without waiting for a click. The YouTube player is the exception: it waits for a play click on its poster. The cookie banner is notice plus withdrawal, not a gate. Reject stops the optional analytics, recording and ads and stores that refusal for 180 days.

Loaded by default, and how to turn it off

On a first visit with no saved choice, the site writes a granted record to ms_consent_v1, requests Google Analytics 4, Microsoft Clarity and both Adsterra units, and then shows the banner so the choice is visible and reversible. The banner has Accept and Reject on every page. Reject rewrites the record as denied for 180 days, sends gtag consent update with the advertising and analytics signals denied, asks Clarity to stop, and removes the Adsterra units from the page. The footer link Cookie settings reopens the banner at any time.

Default-on is the site's default, not a claim that you gave affirmative consent. It is not evidence that notice alone satisfies every jurisdiction. You can withdraw through Reject, and Global Privacy Control (navigator.globalPrivacyControl) or Do Not Track is always treated as Reject. The consent record stays in your browser; no account is required and no choice is sent to a server of ours.

Third parties that actually load

• Google Analytics 4 (Google LLC), property 561438190, web stream 16226951716, measurement ID G-ZT27C32Q0C. It loads from googletagmanager.com on every page view and reports to google-analytics.com. Cookies can include _ga and _ga_ZT27C32Q0C. Purpose: aggregate page views, referrers and engagement. Retention: property-level event-data retention was not independently read back; the _ga cookies can live up to 2 years. Legal basis: our legitimate interest in measuring the guide, and consent where local law requires it. Opt out with the Google Analytics opt-out browser add-on or Google ad settings.
• Microsoft Clarity (Microsoft Corporation), project z56tmcpei9. It loads from clarity.ms and scripts.clarity.ms, records heatmaps and session replays, and reports to *.clarity.ms. Cookies can include _clck, _clsk, CLID, MUID, ANCHK, MR and SM. Purpose: see which sections are read and where the layout fails. Microsoft's FAQ says recordings are available to webmasters for up to 30 days; project-specific retention settings were not independently read back. Clarity masks form inputs and sensitive text by default. Legal basis: our legitimate interest in improving the guide, and consent where local law requires it. Controls: the Microsoft privacy dashboard.
• Adsterra (Adsterra Network), publisher ID 3403020, website ID 6159506. Two units load from bicea.org: Native Banner unit 31981504 (NativeBanner_1) in the page flow, and Social Bar unit 31981505 (SocialBar_1) as a floating unit. Adult ads are disabled for this website. There is no Popunder, Banner or Smartlink unit here. Adsterra and its demand partners may set cookies and read device data on their own domains to cap frequency, prevent fraud and personalize creatives; names are issued per creative and partner. Creatives can also request Adsterra delivery hosts such as static.nresystems.com, cdn.show-sb.com, cdn.show-creative1.com and cdn.cloudpiko.com; the exact set varies by creative. Legal basis: our legitimate interest in advertising revenue, and consent where local law requires it. Opt out through Your Online Choices, the NAI opt-out or the DAA opt-out page; the banner Reject button stops both units on this site.
• YouTube (Google LLC) through youtube-nocookie.com. The player is not requested until you press play on a video poster. Once it starts, Google may set PREF, VISITOR_INFO1_LIVE and YSC and receive the video ID and your IP address. Purpose: play the clip. Retention: according to Google's cookie terms. Legal basis: your play click, plus consent where local law requires it.
• First-party assets and hosting. Pages, CSS, fonts, screenshots and the logo are served from melonsandbox.app; no remote font service is used. The site runs on our own nginx origin, which keeps short-lived request logs for security and operations. There is no traffic-mesh banner SDK, no AdSense, no Popunder and no Smartlink on this site.

Storage, cookies, and retention

The ms_consent_v1 record is a small JSON object with choice and updated. It lives in your browser and is readable only by this origin. The site does not run a second banner library and does not write an advertising cookie itself. GA4 and Clarity may set first-party cookies on this site as well as vendor-domain cookies. Advertising identifiers and their duration depend on the delivered creative and browser settings; we have not verified a universal advertising cookie list or lifetime. Reject stops future analytics and ad requests, but cookies already written stay until they expire or you delete them.

Legal basis and your rights

We rely on legitimate interest for aggregate measurement, session replay, advertising delivery and security, and on consent where local law requires it. The guide itself is published as our own content. Emails you send are kept so we can answer them, then deleted when the thread is done or when you ask. You can ask for a copy, a correction or deletion of those messages at [email protected]. You can also complain to your local data-protection authority. We do not sell personal information.

For personalized advertising you can use Google Ads Settings, aboutads.info, the NAI opt-out and Your Online Choices. These control the networks' own profiles, not the fact that this page requested an ad. Global Privacy Control is honored as Reject.

Changes

Changes to this policy are posted on this page with a new checked date. Cookie settings in the footer reopens the banner, and Reject remains available after any change. If a later build changes an ID or adds a tag, this page has to change in the same commit.