Privacy policy
This policy describes what hostilearchitect.xyz actually loads. It was written to match the code on 13 October 2026. If a script is added later, this page changes in the same update.
Source notes
The site loads its own local scripts, fonts, and images, plus three vendors: a Google Analytics 4 tag, a Microsoft Clarity loader, and two Adsterra ad units — an in-page banner and a floating bar. None of them is requested until you press Accept, so a visit you never answer makes no request to any of the three. Analytics and advertising storage all start denied, video players stay inactive until a video button is clicked, and both Cookie settings and a Hide ad bar control sit in every page footer. One request is not ours to gate and is described below: Cloudflare’s edge adds its own Web Analytics beacon to every page response before it reaches the browser.
Who is responsible
The operator of hostilearchitect.xyz is the contact for this policy: contact@hostilearchitect.xyz. SludgeBit does not operate this site and does not receive your consent choice, and the ads on this site are not sold by SludgeBit.
What is stored in the browser
Key name: ha_consent_v1 in localStorage. Value: a JSON object with choice ("granted" or "denied") and ts (the time you chose). Validity: 180 days; expired or malformed records are removed on the next visit and the banner returns. We do not set a first-party cookie for this. Clearing this origin’s site data also deletes the key.
Second key: ha_adbar_hidden in localStorage, holding "1" only when you press Hide ad bar in the footer. It is what keeps the floating ad bar away on later visits; removing that key (or pressing Show ad bar) brings the bar back. This key is independent of the consent key and is never sent anywhere.
An inline consent stub calls gtag("consent","default") with ad_storage, ad_user_data, ad_personalization, and analytics_storage set to denied, and it turns on ads_data_redaction and url_passthrough. That stub runs before the Google Analytics tag, so the tag starts in denied mode: it stores nothing in your browser and its request to Google carries no identifier for this browser. Accepting later switches all four categories to granted for the rest of the visit and releases the ad loaders; rejecting leaves all four denied.
After Accept, Google Analytics 4 sets its own first-party cookies on this domain to tell visits apart (_ga and _ga_<container id>, with Google’s default two-year lifetime). Reject, the Global Privacy Control signal, or Cookie settings followed by Reject keeps those cookies off. Clearing this origin’s site data removes them.
Microsoft Clarity, the session-recording and heatmap tool, sets two first-party cookies on this domain after Accept: _clck (one year, the browser-level id it reuses on later visits) and _clsk (one day, tying one recording session together). Reject, the Global Privacy Control signal, or a later Cookie settings followed by Reject keeps them off, because the Clarity script is not injected at all without consent. Clarity’s default masking hides the text you type into form fields.
The Adsterra ad scripts are served from Adsterra’s own domains, not from this one, so anything they store is scoped to those domains rather than to this domain: Adsterra identifies browsers on its delivery hosts (the loader for this site’s banner is served from bicea.org) and its privacy policy describes that handling. This site itself sets no advertising cookie, and in our test on 13 October 2026 the two loaders added no cookie and no localStorage key on this domain. Adsterra reports its cookie practice at https://adsterra.com/privacy-policy/, and interest-based advertising can be switched off with the industry opt-outs listed below.
Third parties
Adsterra, the only advertising network on this site. It serves two units on hostilearchitect.xyz: the in-page Native Banner (unit 31706711, publisher website 6119511) and the floating Social Bar (unit 31706712). Both loader scripts are requested from Adsterra’s delivery host bicea.org, and the ad creative itself, plus whatever measurement Adsterra attaches to it, comes from Adsterra and its partners. Adsterra receives the page URL, your IP address, and your user-agent when an ad loads. Its policy is at https://adsterra.com/privacy-policy/. You can also opt out of interest-based advertising from participating companies at https://optout.aboutads.info/, https://optout.networkadvertising.org/, and https://www.youronlinechoices.com/.
Google Analytics 4 (www.googletagmanager.com) and Microsoft Clarity (www.clarity.ms) are the two analytics scripts this site loads, and both are run for the site owner. GA4 measurement requests go to www.google-analytics.com. Clarity’s recording markup, SDK, and uploads come from www.clarity.ms, scripts.clarity.ms, and collect endpoints under *.clarity.ms, which is also where its cookies are scoped; Microsoft describes that handling at https://privacy.microsoft.com/privacystatement. Fonts, screenshots, and the logo are files on this host.
YouTube (Google): choosing Play video loads the privacy-enhanced player from www.youtube-nocookie.com. Google receives the player request and IP address, and may use its own storage. Player resources can come from youtube.com, ytimg.com, googlevideo.com, gstatic.com, and Google service domains. This site does not receive the player’s cookies. Google describes its data handling at https://policies.google.com/privacy.
Cloudflare hosts this site and forwards the contact address above, and it injects its own email-obfuscation script from this domain’s /cdn-cgi/ path, which rewrites the visible contact link so scrapers read a different string. That script runs from this domain, sets no cookie, and pages still load if it is blocked.
Cloudflare Web Analytics also runs on this site, and it is the one third party the cookie banner does not control: Cloudflare’s edge adds the beacon (static.cloudflareinsights.com/beacon.min.js, site token v4bc70e2c01a94c73b74392e4234840661791215815920) to the page response itself, so it is requested on the first byte of every visit, before and regardless of any choice you make, and no script on this site inserts or can remove it. It reports aggregate page views and timings to /cdn-cgi/rum on this domain. It is cookieless, it does not fingerprint you across sites, and it is not used for advertising; the legal basis is legitimate interest in knowing whether pages load. Blocking static.cloudflareinsights.com, or running any content blocker, stops it without affecting the pages. If you follow a link to Steam, Discord, itch.io, Wikipedia, Bandcamp, or YouTube’s own site, that site’s policy applies after you leave. We do not embed those sites.
Advertising and analytics
This site runs ads from one network, Adsterra. There is no AdSense account and no second network, so /ads.txt declares exactly one seller: adsterra.com, 3403020, DIRECT. That publisher id comes from the Adsterra dashboard for this account; ids are never guessed, because a wrong ads.txt line is worse than none. Adult and explicit ad categories are switched off in this site’s Adsterra configuration, so the network’s erotic-advertising pool is not eligible for this domain.
No ad script is part of the page you receive. The consent stub starts with ad_storage, ad_user_data, and ad_personalization all denied and with ads_data_redaction on, and only Accept switches them to granted and injects the two Adsterra loaders. A rejected visit, a visit answered by the Global Privacy Control signal, and a visit where the banner was ignored make no request to Adsterra at all — the loader scripts never enter the page, and the space reserved for the banner stays empty and collapsed.
Cookie settings followed by Reject takes the ad loaders back out of the page in that same page view: both Adsterra scripts are removed, the banner frame is emptied, and the floating bar is removed. This cannot recall an ad request that already happened, and a cookie Adsterra set on its own domain is outside this site’s reach, but it stops further ad requests from the page. Google Analytics 4 and Microsoft Clarity are the two analytics tools, and Clarity records sessions and heatmaps only after you accept.
Clarity is not unloaded when you reject an earlier Accept without reloading: the recording tag that has already started keeps running for the rest of that page view, so reload the page after rejecting if you want it to stop immediately. It is not injected on any later page view while the stored choice is denied. Analytics storage starts denied, so the GA4 tag measures nothing about your browser until you choose. Accept grants everything and enables the analytics and advertising cookies described above; Reject keeps all four categories denied, and the GA4 tag continues to send Google a cookie-less ping that carries no identifier for this browser. Clicking a video is a separate request to load YouTube, and Cookie settings followed by Reject also removes active video players. Advertising or recording scripts are enabled only by updating the code, this policy, and the consent controls together, which is what this change did.
The floating ad bar
The Social Bar is the one format on this site that floats over the page instead of sitting inside it. Because a floating element can cover content or widen a page, it is constrained from this site’s own code rather than left to the vendor’s styling: whatever Adsterra anchors to the viewport is clamped to the screen width (max-width: 100vw, border-box sizing, no horizontal overflow), the document reserves space at its end so the bar cannot sit on top of the footer, and the bar is hidden while the cookie panel is open so it cannot cover the choice you are asked to make.
It can also be turned off on its own, without touching your consent choice: Hide ad bar in every page footer stores ha_adbar_hidden in localStorage, and while that key is "1" the Social Bar loader is never injected again — it stays away across visits and reloads, not only until the next refresh. Show ad bar removes the key and brings it back. The in-page banner keeps working either way, so hiding the bar is not an ad blocker and does not withdraw consent.
Contact email
Messages sent to contact@hostilearchitect.xyz are forwarded through Cloudflare Email Routing to the operator’s inbox. Cloudflare processes the message for forwarding. The operator uses the message and reply address to handle your correction or privacy request. This mail routing does not load a Cloudflare tracking script in your browser.
GPC, rights, and changes
If the browser sets navigator.globalPrivacyControl, the page stores a denied choice and does not wait for a click. A Do Not Track header is not required for that path; the Global Privacy Control flag is what the script reads.
You can ask for the localStorage record to be explained, or delete it yourself in the browser. Email a privacy request to the address above. There is no account, so there is no profile to export. We do not sell personal information; the advertising on this site is bought and sold by Adsterra, and the opt-out links above are how you leave its interest-based advertising.
Legal basis for serving the pages is the operation of the site. Legal basis for the consent key, for analytics storage, and for the ad loaders is consent, which you can withdraw with Cookie settings in the footer. Policy changes are posted on this page with a new updated date.
Questions
Do you use cookies for ads?
This site sets no advertising cookie of its own. The ad scripts run from Adsterra’s domains (bicea.org and the delivery hosts behind it), so anything they store is scoped there; in our 13 October 2026 test they added no cookie and no localStorage key on this domain. Accepting grants ad_storage, ad_user_data, and ad_personalization in Consent Mode v2 so the ads may load — that is the only advertising storage this site asks for, and Reject keeps all three denied and takes the ad loaders out of the page.
What analytics does the site run?
Google Analytics 4 and Microsoft Clarity, both gated the same way. GA4 starts with analytics_storage denied, so it writes no cookie and sends no identifier for your browser until you press Accept; Clarity’s script is not even injected before that. Reject leaves GA4 in its cookie-less mode and loads no Clarity.
How do I get rid of the floating ad bar?
Press Hide ad bar in the footer. The choice is stored in localStorage and the Social Bar loader is not injected on later visits, so it stays hidden across reloads. Show ad bar brings it back. The in-page banner is not affected.
Can I turn the ads off completely?
Reject on the cookie banner, or Cookie settings followed by Reject, keeps the ad loaders out of the page and removes them if they were already running in that page view. An ad blocker also works, and the ads.txt file lists the single seller this site uses.
Sources
- Google Privacy Policy — Covers Google Analytics and the YouTube player
- Microsoft privacy statement — Covers Microsoft Clarity recordings
- Adsterra Privacy Policy — Covers the ad units served on this site
- AdChoices opt-out — Industry opt-out for interest-based advertising