Who is responsible
The operator of bubble-shooter.xyz is the controller for this site. Email [email protected]. No separate company name is used in public, so this page names the domain and that mailbox as the contact point.
What loads on the first view
Google Consent Mode v2 is initialized before GA4 config: ad_storage, ad_user_data and ad_personalization default to denied, analytics_storage defaults to granted, and ads_data_redaction is enabled. Separately, this site's loader treats a missing or expired choice as granted: it immediately updates the consent signals and requests Google Analytics 4 (measurement ID G-7NRY8MRYLH), Microsoft Clarity (project z29fmv747p) and Adsterra (publisher 3403020, ad units 31884851 and 31884852) on the first view. These vendors load by default; Reject prevents subsequent loads. The cookie banner remains visible as a notice and withdrawal control. Reject stores a denial for 180 days, disables further analytics collection, removes vendor elements, hides ad slots, and reloads into the stored denial; an already-started network request cannot be recalled. Accept stores a grant for 180 days.
YouTube is the exception. Videos stay behind a play button and are requested from youtube-nocookie.com only after you click. The game iframe is also click-to-load and is covered further down.
Storage keys and cookies
| Key | Owner | Where | Purpose | Retention |
|---|---|---|---|---|
| bsx-consent | This site | localStorage | Remembers Accept or Reject, plus ad_storage, ad_user_data, ad_personalization and analytics_storage flags | 180 days |
| bsx-socialbar-closed | This site | localStorage | Remembers that the fixed Social Bar was closed, so it does not return on the next page | 180 days |
| _ga, _ga_* | Google Analytics 4 | Cookie on bubble-shooter.xyz | Distinguishes browsers and keeps campaign attribution | Cookies can last up to 2 years; event retention depends on the property settings |
| _clck, _clsk | Microsoft Clarity | Cookie on bubble-shooter.xyz | Joins page views into one recording and stores the session identifier | About 1 year and 1 day |
| MUID, CLID | Microsoft | Cookie on clarity.ms and related Microsoft domains | Microsoft identity and Clarity session handling | Up to 1 year |
| __cf_bm | Adsterra CDN (bicea.org) | Cookie on bicea.org | Cloudflare bot management for the ad request | About 30 minutes |
| Adsterra ad cookies | Adsterra and its demand partners | Cookie on bicea.org and ad iframes | Frequency capping, fraud checks and ad attribution; names vary by campaign | Set by Adsterra, usually days to 1 year |
The site's own consent and ad-close code uses localStorage, not cookies. GA4 and Clarity may set the first-party cookies listed above. Fonts and images are files on this domain, not requests to a font or image host. There is no account, no newsletter and no server-side profile.
Google Analytics 4
GA4 is loaded through gtag.js from googletagmanager.com with measurement ID G-7NRY8MRYLH. It records page views, approximate location derived from IP, device and browser information, and events such as outbound clicks. IP addresses are not logged by GA4. Google acts as our processor; data may be processed outside the EEA under Google's safeguards. Google's privacy policy is at https://policies.google.com/privacy and the opt-out browser add-on is at https://tools.google.com/dlpage/gaoptout.
Microsoft Clarity
Clarity is loaded from clarity.ms and its subdomains (*.clarity.ms) with project ID z29fmv747p. It collects pseudonymous session replays and heatmaps: clicks, scrolls, taps and page navigation. Privacy-sensitive fields are masked by Clarity; masking is not a promise that every visible page detail is anonymous. Data retention depends on the data type and Microsoft's current service policy. Microsoft's privacy statement is at https://privacy.microsoft.com/privacystatement and the Clarity data page is at https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data.
Adsterra advertising
Adsterra supplies the two ad placements on this site: a Native Banner (unit 31884851) inside the page and a Social Bar (unit 31884852) fixed to the bottom of the viewport. The scripts come from bicea.org, Adsterra's delivery host. Adsterra and its demand partners may set cookies or read device signals to cap frequency, detect invalid traffic, measure conversions and personalise ads. Adult ads are switched off for this publisher account. Adsterra's privacy policy is at https://adsterra.com/privacy-policy/.
You can limit personalised advertising at https://adssettings.google.com, https://optout.aboutads.info/ and https://www.youronlinechoices.eu/. Those are industry and Google controls, not switches operated by this site. Reject on this site stops this site's Adsterra request; it does not delete cookies that Adsterra already set, which you can clear in your browser.
Legal basis
The loader's first-visit behavior is described above: absent a stored Reject it requests analytics, session recording and advertising while the banner is visible. Use Reject to store a denial for 180 days, or reopen Cookie settings from the footer to change a saved decision. Security and fraud-prevention signals, such as the Cloudflare bot cookie on the Adsterra delivery host, may be processed to keep requests available. This notice is not legal advice; the site operator should review the lawful basis and consent design for each region before launch.
The game iframe and YouTube
The selected Bubble Shooter game iframe is created only when you press Play. Until that click the browser does not request the publisher game. After the click, bubbleshooter.com and Ilyon receive your IP address as part of a normal page load, may set their own cookies and may show the game's ads. Their cookie note is at bubbleshooter.com/policy and their privacy policy is at private.ilyon.net/privacy-policy. The publisher's current ads.txt entries are included at this domain as required by its embed terms; Adsterra's separate seller entry describes this site's own ad placements.
Google Analytics is requested from googletagmanager.com and google-analytics.com and their subdomains; Clarity is requested from *.clarity.ms, including www.clarity.ms, scripts.clarity.ms and collection hosts observed during testing such as b.clarity.ms, r.clarity.ms and g.clarity.ms. Adsterra placements are requested from bicea.org and can create advertising frames on partner domains. These analytics and advertising vendors load by default on a first visit; Reject prevents subsequent loads. YouTube videos use youtube-nocookie.com only after you press a video's play button. These are the third-party services currently loaded by the page; any vendor or host change must be reflected here.
Do Not Track and Global Privacy Control
If the browser exposes navigator.globalPrivacyControl as true, the page updates all consent signals to denied before any vendor script is created and writes bsx-consent as denied. The initial Consent Mode default described above is immediately overridden; GA4 is not loaded. A Do Not Track header is not a reliable signal in current browsers, so GPC is the signal the script honors. Reject in the banner also writes a denied record.
Your rights
Depending on where you live you may have the right to access, correct, delete, or export personal data, to object, and to complain to a supervisory authority. Email [email protected]. Because the choice record sits in your browser, clearing localStorage for this origin deletes it immediately. For data held by Google, Microsoft or Adsterra, use the links above or write to us and we will pass the request to the relevant processor. We have no account database to search.
Changes
If a new script or a new storage key is added, this page changes in the same release and the date below moves with it. The current date is 23 October 2026.
Questions people ask
Do the analytics and ad tags load before I press Accept?
Yes. Consent Mode starts with the three advertising storage signals denied and analytics_storage granted. If there is no current Reject record, the page immediately updates Consent Mode to granted and requests GA4, Clarity and Adsterra on the first view while the banner remains visible. Reject stores a denial for 180 days and stops later loads; an already-started network request may finish.
How do I change my choice?
Use Cookie settings in the footer. Reject stores a denied record and removes the vendor scripts. Accept stores a granted record. Both expire after 180 days.
Sources checked 2026-10-23
- bubbleshooter.com cookie policy — accessed 2026-10-23
- Ilyon privacy — accessed 2026-10-23
- bubbleshooter.com games for your site — accessed 2026-10-23
Checked on 2026-10-23. Ratings, install bands, and file sizes are store snapshots, not live counters.