Privacy · Updated 2026-10-28
Privacy policy
This page names every third party the site actually loads, the storage each one uses, and how to turn the optional ones off.
What loads on every page
| Party | Purpose | When it loads |
|---|---|---|
| rochess.org (this host) | Serves the guide pages, images and the consent record | Every request; no third-party script is needed for the page to render |
| Cloudflare Web Analytics (static.cloudflareinsights.com) | Cookieless page-view and Core Web Vitals measurement, injected by the hosting edge | First paint, by default |
| Google Analytics 4 — measurement ID G-905QCSZ87V | Counts page views and aggregate traffic sources | First paint, by default |
| Microsoft Clarity — project z4id5l2i5w | Heatmaps and session recordings, with sensitive fields masked by Clarity | First paint, by default |
| Adsterra — Native Banner NativeBanner_1 (unit 31959182) and Social Bar SocialBar_1 (unit 31959183) | Serves the sponsored Native Banner in the page and the fixed Social Bar overlay | First paint, by default |
| YouTube (youtube-nocookie.com) | Plays a cited video | Only after you press Play on that video |
The GA4, Clarity and Adsterra tags are not written into the HTML as <script src> elements. A first-party loader in the page creates all three after the HTML is parsed, so they start with the first screen but do not block it, and a stored Reject keeps them from being created on later visits. GA4, Clarity, both Adsterra units and Cloudflare's cookieless beacon are on for a first visit; Reject turns GA4, Clarity and both Adsterra units off, and the beacon is left to Cloudflare's own cookieless counting.
Cookies and local storage
The site itself sets no cookies. It writes two localStorage keys on rochess.org. The other rows are cookies set by the vendors' own hosts after their scripts run; their names and lifetimes are controlled by those vendors.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
| rochess.org.choice (localStorage) | rochess.org | The banner record: ads is granted or denied, plus reason, timestamp and expiry | 180 days |
| rochess.org.adbar.closed (localStorage) | rochess.org | Remembers that you closed the Adsterra Social Bar | 180 days |
| _ga | google-analytics.com | Distinguishes browsers for aggregate measurement | 2 years |
| _ga_905QCSZ87V | google-analytics.com | Keeps GA4 session state for this measurement ID | 2 years |
| _clck | clarity.ms | Clarity user identifier used to stitch a visit | 1 year |
| _clsk | clarity.ms | Clarity session identifier used for recordings and heatmaps | 1 day |
| CLID | clarity.ms | Microsoft Clarity identifier | 1 year |
| MUID | clarity.ms / microsoft.com | Microsoft user identifier used by Clarity | 1 year |
| pip_<32 hex characters> | bicea.org | Adsterra delivery and frequency control for the two units | 1 day or the browser session |
| __cf_bm | bicea.org | Cloudflare bot management on Adsterra's delivery host | 30 minutes |
| uid_id2, ak, acl | static.nresystems.com | Adsterra creative delivery and measurement | About 13 months for uid_id2; about 90 days for ak and acl |
| YouTube cookies such as YSC, PREF and VISITOR_INFO1_LIVE | youtube-nocookie.com / youtube.com | Playback, preferences and view measurement after you start a video | Set and controlled by Google; from the session to about 2 years |
Adsterra's delivery host and creative CDNs rotate. The current requests reach bicea.org, static.nresystems.com, cdn.storageimagedisplay.com, cdn.show-sb.com, cdn.show-creative1.com, cdn.holdbitter.com and cdn.cloudpiko.com; the Social Bar notification may also request the Roboto font from fonts.googleapis.com and fonts.gstatic.com. Those hosts receive your IP address, user agent and the page you came from when the browser requests a creative or a notification file.
Default on, and how to turn it off
On a first visit with no stored choice, the page writes ads: "granted", updates Google Consent Mode v2 to granted, starts GA4, Clarity and both Adsterra units with the first paint, and shows the banner. The banner is a notice and a withdrawal control; it does not hold the scripts back while it waits for a click.
Reject overwrites the record with denied for 180 days. The page then removes the GA4, Clarity and Adsterra script tags and their slots, hides the native unit and the Social Bar, and updates gtag so analytics_storage and the three ad signals are denied. Accept keeps the granted record. Cookie settings in the footer reopens the banner so you can change the choice at any time. When the 180-day record expires, the next visit is a new default-on visit.
If navigator.globalPrivacyControl is true, or Do Not Track is 1, the page treats the visit as Reject and does not show advertising or recording scripts. The Social Bar also has its own Hide ad bar button: closing it stores rochess.org.adbar.closed for 180 days, so the bar does not come back on reload or on the next page.
The Adsterra units are sized and clipped locally. The native slot is constrained to the content width, the Social Bar is constrained to 100vw with overflow: hidden, and the page reserves bottom padding while the bar is present.
Legal basis, retention and your choices
Where the GDPR or UK GDPR applies, the legal basis for GA4, Microsoft Clarity and Adsterra is consent (Article 6(1)(a)). You give it through the default-on notice and withdraw it with Reject or Cookie settings. Hosting and security logs rely on legitimate interests (Article 6(1)(f)) in keeping the site available and secure. Where local law requires opt-in rather than opt-out, the banner record is the evidence of the choice, and Global Privacy Control is always honoured.
Google Analytics 4 keeps event-level data for 2 months by default; the property can be set to retain it for up to 14 months. Microsoft Clarity keeps session recordings for 30 days and aggregated heatmap data for up to 13 months. Adsterra and YouTube keep data under their own policies and retention settings, which this site does not control.
You can object to or withdraw consent at any time, ask what the site holds, or ask for deletion by writing to [email protected]. The site itself holds only the two localStorage keys in your browser; deleting them clears the record. For personalised advertising, use Google Ads Settings, the industry opt-out at optout.aboutads.info, the NAI opt-out at optout.networkadvertising.org, or Adsterra's own privacy page. Those choices are per browser and per vendor; Reject on this site is the switch for this site.
This policy changes when a tag or a storage key changes, and the date at the top moves with it. Questions go to the contact page.
Questions
Do I have to press Accept before analytics and ads run?
No. A first visit is treated as granted, so GA4, Clarity and Adsterra start with the page and the banner explains that. Reject is the control that turns them off and remembers the choice for 180 days.
What exactly does Reject turn off?
It removes the Clarity and Adsterra scripts and their slots, hides the Social Bar, and updates Google Consent Mode so analytics_storage and the ad signals are denied. The guide pages themselves keep working.
Does rochess.org set its own cookies?
No. The site writes only rochess.org.choice (the banner record) and rochess.org.adbar.closed (the Social Bar close state) in localStorage. The cookies in the table are set by Google, Microsoft, Adsterra or YouTube.
Does the video load YouTube immediately?
No. The page shows a preview; the youtube-nocookie.com iframe is created only after you press Play on that video.
How long is my choice remembered?
180 days. Cookie settings in the footer reopens the banner, and Reject can be chosen again at any time.
Where do I opt out of personalised ads?
Use Google Ads Settings, optout.aboutads.info or optout.networkadvertising.org. Reject on this site turns off Adsterra for rochess.org but does not change other sites.
Keep reading
Sources and last checked (UTC)
- Google privacy policy — GA4 and YouTube data handling, accessed 2026-10-28.
- GA4 data retention — Event data retention: 2 months by default, up to 14 months.
- Microsoft privacy statement — Microsoft Clarity data handling, accessed 2026-10-28.
- Adsterra privacy policy — Adsterra cookie and retention terms, accessed 2026-10-28.
- Google Ads Settings — Personalised advertising opt-out.
- AboutAds opt out — Industry opt-out for participating advertisers.